Extracts the dev-mode acknowledgement decision into a pure check_dev_acknowledgement(secret, dev_mode, dev_ack) called by from_env before key resolution, and pins that dev mode without a secret and without PICLOUD_DEV_INSECURE_KEY is refused. Behavior-preserving. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>