export_yaml masks global_headers and tool_options, and import_yaml feeds
that document straight into create(), which had nothing to unmask it
against. Exporting an engine that carried auth and importing it back
produced an engine that sent `Authorization: ••••••••` to every target
and handed nuclei `-api-key ••••••••`.
Both validators now refuse a value carrying the mask, naming the header
or the tool. update() keeps working: it restores the stored value first
and validates what it is about to store, rather than what was submitted,
so the editor can keep sending masked values back.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ
