#4392 Manual: Sensitive Method Arguments claims a literal value is refused, but a method run accepts it

content/manual/reference/vaults.md, section Sensitive Method Arguments, says the runtime enforces that sensitive argument values must be vault.get() expressions.

Observed with swamp 20261103.172234.0-sha.b94358f0: an extension method argument declared z.string().meta({ sensitive: true }) and set to a literal (apiToken: plain-literal-value) in the definition YAML runs and succeeds through swamp behavior run, and the method receives the literal.

swamp's validation_service.ts has findLiteralSensitiveGlobalArgs and a refuseLiteralSensitiveGlobals option, so the literal check covers global arguments (and only where that option is set), not method arguments.

Either the manual should say what is actually enforced (which argument kinds, which commands), or swamp should refuse the literal for method arguments too. Found while working swamp-club#4389.