Function mask_env_overrides_for_save 

pub fn mask_env_overrides_for_save(
    config_to_save: &mut Config,
    snapshots: &HashMap<String, String>,
) -> Result<()>

Restore env-overridden paths in a save-bound clone to their pre-override snapshots, so env-injected values never reach encrypt_secrets() or the on-disk TOML.

Snapshots come from apply_env_overrides which captures the post-decrypt_secrets plaintext for secret fields. After this restore, encrypt_secrets() re-encrypts the recovered plaintext to fresh ciphertext that decrypts to the same value — preserving the operator’s real on-disk credential across env-override + save cycles.