Codigniter 4.6.1 not loading config files based on environment

What you're describing sounds more and more like a combination of Running Multiple Applications with one CodeIgniter Installation, Handling Multiple Environments, and Code Modules.

CodeIgniter can already reasonably do what you want it to do within the architecture it provides. The environment file allows you to change App/Config values for your application. Code modules allow you to separate/isolate your code from the "default" App code. Having multiple apps running under the same framework allows you to achieve programmatic/structural differences between two apps without the need for convoluted exceptions/switches.

Having the .env file set up somewhere else in your structure isn't any "safer" (security through obscurity isn't a good practice). If an attacker gains access to your server with root permissions they can locate the .env file (even if you rename the file as its internal structure is readily identifiable). If your clients can see into other client's directories that's a permissions issue that you should address at the file/directory level (i.e. chmod/chown). The app directory is implicitly supposed to be restricted access.

Your description of your setup has incongruencies nuanced to you; not necessarily how best to operate applications within the framework. Review your architecture and reevaluate how you're approaching things.

Halberd | CodeIgniter Sandbox