Match CLI versions before interpreting missing secret keys
When a Railway environment gate fails locally but CI uses another CLI version, compare the exact serializers before changing credentials or validation. A newer CLI can include sealed keys with null values while an older version omits those keys entirely. A string-only validator t…