fix(security): block dotenv variants from agent and IDE IO

[cursor]

Summary

• Agent read_file / write_file and the desktop IDE workspace editor treated .env as a hard-blocked sensitive path, but the check only matched an exact .env suffix or a /.env/ directory.
• Common dotenv files (.env.local, .env.production, .envrc) were readable and writable. In a Vite/Next.js workspace this leaks values such as DATABASE_URL into the model context, or lets the agent overwrite local env files.
• The fix treats path components named .env, .envrc, or starting with .env. as sensitive, keeping existing .key / .pem / .git/config blocks.

Task Linkage

• Task ID: TASK-2026-071
• Task folder: tasks/TASK-2026-071-block-dotenv-variants/

Injected Specs

• spec/security-nonnegotiables.md (if sandbox/security changed)
• spec/testing-policy.md (required for any code change)
• spec/docs-sync.md (if behavior/docs/env/commands changed)
• spec/architecture-boundaries.md (if architecture/layering changed)

Validation Evidence

• Commands executed:
  • python3 scripts/validate_tasks.py — passed (71 task directories)
  • cargo fmt --check — exit 0
  • cargo clippy --all-targets -- -D warnings — exit 0
  • cargo test -p skilllite-agent — 251 passed, 0 failed
  • cargo test (workspace) — all crates ok, 0 failed
  • Assistant crate tests not run: gdk-3.0 missing in this environment
• Key results:
  • test_read_file_blocks_dotenv_variants passed
  • test_write_file_blocks_dotenv_variants passed
  • blocks_dotenv_and_common_variants passed
  • src/env.rs / environment.json still allowed

Regression Scope

• Areas likely affected:
  • Agent file tools (read_file, write_file, search_replace, insert_lines)
  • Desktop IDE workspace read/write/list
• Explicit non-goals:
  • ChatSession workspace-root alignment (Fix desktop workspace chat root mismatches #114)
  • Evolution restore atomicity (fix(evolution): restore snapshots without deleting live trees first #142)
  • Symlink canonicalize (fix(security): reject symlink and path-containment escapes #132)

Docs Sync (EN/ZH)

• Updated EN + ZH docs
• Files:
  • docs/en/ARCHITECTURE.md
  • docs/zh/ARCHITECTURE.md
  • crates/skilllite-assistant/README.md

Review Checklist

• Acceptance criteria in tasks/TASK-2026-071-block-dotenv-variants/TASK.md satisfied (or explicitly deferred)
• tasks/TASK-2026-071-block-dotenv-variants/STATUS.md updated with latest progress
• tasks/TASK-2026-071-block-dotenv-variants/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date