fix(security): ignore .env so a generated portal skill's API token can't be committed (#303)

/add-portal can generate a skill for a portal that only returns usable
content through a paid fetching service, and such a skill reads its API
token from the environment. Nothing stopped the `.env` holding that token
from being committed: `.gitignore` had no `.env` rule, and
`REQUIRED_IGNORE_RULES` in tools/security_guards.py did not pin one.

No shipped portal needs a credential - all six are free and
unauthenticated - so upstream has never hit this. A fork whose generated
portals do need one hits it on the first `git add -A`.

Add `.env` and `.env.*` to `.gitignore`, and pin both in
`REQUIRED_IGNORE_RULES` so the guard fails if the rule is later dropped.
No negation rule is added, so `ALLOWED_IGNORE_NEGATIONS` is untouched.

Verified:
  - `printf 'X=y' > .env && git check-ignore -v .env` -> matched
  - dropping the `.env` line makes `python3 tools/security_guards.py`
    report the missing rule and fail; restoring it returns OK
  - `lint_skills`, `check_framework_version`, `security_guards` all OK;
    `python3 -m unittest discover -s tests` 196 passed

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

tools/security_guards.py

@@ -70,6 +70,11 @@ REQUIRED_IGNORE_RULES = [
     "gmail_sync/",
     "reports/",
     "upskill/*.md",
+    # Not personal data but the same failure mode: /add-portal can generate a
+    # skill for a portal that only returns usable content through a paid
+    # fetching service, and that skill reads an API token from the environment.
+    ".env",
+    ".env.*",
 ]
 
 # Negation (re-include) rules the template legitimately ships. .gitignore is