.env Validator

A `.env` file fails quietly. A loader that hits a malformed line typically either skips it or throws with no line number, and a shadowed key — the same NAME set twice — never surfaces at all, because the last value wins and the earlier one simply never took effect. This checks every line on its own and names the ones a loader would mishandle.

Every line gets a verdict, not just the first bad one

A malformed line does not stop the scan. Real `.env` files are edited by hand over months, and the useful report is "these four lines have a problem," not a single exception pointing at the first one.

What "duplicate key" actually means here

Every real `.env` loader — dotenv, Docker's `--env-file`, Compose — keeps the last occurrence of a repeated key and silently drops the earlier ones. That is not a syntax error, so it produces no error message anywhere else; it is reported here specifically because it is the shadowing bug that is otherwise invisible.

$VAR references are flagged, not resolved

Plain `.env` files do not expand shell-style variable references, so a value of ${DATABASE_URL} is not an error — it is an honest question about which loader you are targeting, since Compose and `dotenv-expand` would resolve it and plain `dotenv` would not. Each occurrence is called out so you can check.

PORT=8080 followed later by PORT=3000 reports the first as shadowed — the file's own later line already overrides it, silently, which is exactly the kind of bug that survives a code review because nothing about it looks wrong on either line in isolation.