chore: gitignore .env / credentials files

A .env file at the repo root was used to plumb a Gitea PAT to the
release workflow's API calls. It wasn't gitignored — risk of an
accidental `git add -A` shipping the secret to the public-ish remote.

Add .env / .env.* / *.token / *.pat to .gitignore so secrets stay
local. No content changes to .env itself; that file remains untracked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -16,6 +16,12 @@ build/rootfs-work/
 *.swo
 *~
 
+# Secrets — never commit
+.env
+.env.*
+*.token
+*.pat
+
 # OS
 .DS_Store
 ._*