Add Mix.env() check to match?/3 for defense in depth. Document NoActor pattern in CODE_GUIDELINES.md.
This prevents security issues where :create/:read without actor would be allowed in production. Now all operations require an actor in production.