Match CLI versions before interpreting missing secret keys

When a Railway environment gate fails locally but CI uses another CLI version, compare the exact serializers before changing credentials or validation. A newer CLI can include sealed keys with null values while an older version omits those keys entirely. A string-only validator therefore fails differently across versions, and an omitted key cannot prove that a forbidden sealed variable is absent. Reproduce with the pinned CI binary, then use sealed-aware presence metadata for absence checks and separate runtime evidence for credential capability. This does not justify treating unreadable values as verified expected values.

Applies when: Local and CI tooling disagree about redacted environment-variable output. Keywords: Railway CLI version sealed variables null omitted JSON validation secrets