fix: inject/run 仅注入 secrets 字段，不含 metadata

- build_injected_env_map 不再合并 metadata
- 删除 build_metadata_env_map 及其测试
- 更新 README、AGENTS.md 文档
- bump 版本至 0.9.5

Made-with: Cursor

src/commands/search.rs

@@ -312,25 +312,7 @@ fn env_prefix(entry: &Entry, prefix: &str) -> String {
     }
 }
 
-/// Build a flat KEY=VALUE map from metadata only (no master key required).
-pub fn build_metadata_env_map(entry: &Entry, prefix: &str) -> HashMap<String, String> {
-    let effective_prefix = env_prefix(entry, prefix);
-    let mut map = HashMap::new();
-
-    if let Some(meta) = entry.metadata.as_object() {
-        for (k, v) in meta {
-            let key = format!(
-                "{}_{}",
-                effective_prefix,
-                k.to_uppercase().replace(['-', '.'], "_")
-            );
-            map.insert(key, json_value_to_env_string(v));
-        }
-    }
-    map
-}
-
-/// Build a flat KEY=VALUE map from metadata + decrypted secret fields.
+/// Build a flat KEY=VALUE map from decrypted secret fields only.
 /// Resolves key_ref: if metadata.key_ref is set, merges secret fields from that key entry.
 pub async fn build_injected_env_map(
     pool: &PgPool,
@@ -340,7 +322,7 @@ pub async fn build_injected_env_map(
     fields: &[SecretField],
 ) -> Result<HashMap<String, String>> {
     let effective_prefix = env_prefix(entry, prefix);
-    let mut map = build_metadata_env_map(entry, prefix);
+    let mut map = HashMap::new();
 
     // Decrypt each secret field and add to env map.
     for f in fields {
@@ -565,22 +547,6 @@ mod tests {
         assert!(err.to_string().contains("sensitive"));
     }
 
-    #[test]
-    fn metadata_env_map_excludes_secret_values() {
-        let entry = sample_entry();
-        let map = build_metadata_env_map(&entry, "");
-
-        assert_eq!(
-            map.get("GITEA_MAIN_URL").map(String::as_str),
-            Some("https://code.example.com")
-        );
-        assert_eq!(
-            map.get("GITEA_MAIN_ENABLED").map(String::as_str),
-            Some("true")
-        );
-        assert!(!map.contains_key("GITEA_MAIN_TOKEN"));
-    }
-
     #[test]
     fn to_json_full_includes_secrets_schema() {
         let entry = sample_entry();