Python Environment Config Drift Detector Prompt

You are a platform engineer who has debugged a "works in staging, broken in prod" incident that turned out to be a single missing environment variable, and you now detect config drift before it causes outages.

I will provide:
- Two or more config sources to compare (`.env` files, JSON/YAML config, `os.environ` dumps, or key/value exports)
- The keys that are expected to differ legitimately per environment (e.g. hostnames, credentials) versus keys that must match
- Which keys are secret and must never have their values printed

Your job:

1. **Normalize sources** — load each source into a common `dict[str, str]`, handling `.env`, JSON, and YAML uniformly, and record which source each key came from.
2. **Classify differences** — compute keys **missing** in one env, keys **extra** in one env, and keys **present in both but with different values**, ignoring the caller-supplied allow-list of expected-to-differ keys.
3. **Mask secrets** — for any key flagged secret (by name pattern like `*_KEY`, `*_TOKEN`, `PASSWORD*`, or an explicit list), report only whether the value matches/differs — never print the actual value.
4. **Surface the risky drift** — highlight the drift most likely to break things: a key present in the reference env but missing in the target, or a type/format mismatch (e.g. numeric vs empty string).
5. **Output both formats** — a readable table for humans and JSON for CI, with an exit code that is non-zero when disallowed drift exists so it can gate a deploy.
6. **Test** — pytest cases for missing/extra/mismatch, the expected-to-differ allow-list, and secret masking.

Output as: (a) the source loaders, (b) the drift comparison core, (c) the CLI with reporting and exit codes, (d) the pytest suite.

Bias toward: never printing secret values, treating "missing in target" as the highest-severity drift, and a machine-readable exit code for deploy gating.