Constant SENSITIVE_PROPERTY_NAMES 

pub const SENSITIVE_PROPERTY_NAMES: &[&str];

Property names we refuse to put into a form-mode elicitation schema.

Per the ACP RFD and MCP’s parent spec, form-mode elicitation MUST NOT be used for sensitive data (credentials, API keys, etc.). All Phase 1 in-tree callers ship a fixed "choice" / "choices" property name, so a match against this list is a contract violation by an in-tree caller, not user-controlled input. We debug_assert! rather than bail! so production builds aren’t degraded by a string scan.