test: prevent private key logging in examples

[Luzijano]

Summary

• removes an example console.log(evmPrivateKey) from README usage docs
• removes the test-suite log of process.env.evmPrivateKey
• adds a regression test to keep EVM private-key env vars out of example/test logging paths

Validation

• RED before fix: npx jest src/__tests__/SecretLogging.test.ts --runInBand failed on the README private-key log
• GREEN after fix: npx jest src/__tests__/SecretLogging.test.ts --runInBand
• npx eslint src/__tests__/SecretLogging.test.ts src/__tests__/WBGL.test.ts --ext .ts
• git diff --check

Notes: npm install --ignore-scripts hit the repo's existing npm peer dependency resolver conflict; dependency installation succeeded with --legacy-peer-deps. The Hermes patch tool's automatic TypeScript check also exposed the existing TypeScript/@types/node version mismatch, so I kept validation focused on the new regression test and touched test lint.

Submitted under the Bitgesell bounty/improvement program (BitgesellOfficial/bitgesell#81). No payout address posted unless/until accepted or requested.

AI/tooling disclosure: prepared with Hermes Agent automation.

[MyTH-zyxeon]

Review assist for maintainers:

This is a small but security-relevant cleanup: it removes example/test logging of EVM private-key material and adds a regression test that scans the README and WBGL test file for direct console.log(...) patterns involving EVM_PRIVATE_KEY / evmPrivateKey.

Suggested merge checks:

• Run the focused Jest test from the PR body and the repo's normal test target to confirm the new static regression test is included in CI.
• Confirm the regex guard covers the intended docs/test logging paths without creating noisy failures for unrelated debug output.
• Consider adding any other example files that load private keys to the filesToCheck list if the SDK has more usage snippets outside README.md and src/__tests__/WBGL.test.ts.

I do not see signing, wallet-generation, broadcast, bridge runtime, or live RPC behavior changes in this patch as written; the acceptance criterion is that examples/tests stop printing private-key values and that future direct regressions are caught before merge.