fix(P07): harden .gitignore for .env and document pre-existing secret leak

Layer-3 security audit during P07 EXECUTE found that .env (containing
GITEA_TOKEN) was committed in 0cba1aa during P00 and remained in git
history. The pre-P07 .gitignore only excluded .env.local, not .env.

This commit:
1. Adds .env to .gitignore alongside .env.local (forward fix — prevents
   future re-tracking).
2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md
   with mitigation steps and required human actions (token rotation,
   history rewrite, access-log audit, CI secret scanning).

The backfill script itself (commit de69788) does not leak the secret: it
sources .env from disk and never echoes or passes it on the command line.
The leak is upstream of P07 and is documented as P0 for the human to
remediate out-of-band.

---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
  covered: [REQ-007]
  partial: []
---/ci---

.ciagent/PHASE7_SECURITY_AUDIT.md

@@ -0,0 +1,57 @@
+---
+description: P07 Layer-3 security audit finding — pre-existing .env secret leak in git history at 0cba1aa
+---
+
+# Phase 7 Security Audit Finding
+
+**Severity**: P0 (secret in git history)
+**Status**: Mitigated going forward; full remediation requires human action
+**Found by**: ciagent verify (Layer 3 — security) during P07 EXECUTE
+**Commit in history**: `0cba1aa` — `chore(P00): set autonomy level to full`
+
+## Finding
+
+The `.env` file (containing `GITEA_TOKEN=795e...67aa` and `GITEA_USER=cloudinit-bot`)
+was committed in `0cba1aa` during P00 and has remained in git history since.
+It is reachable on the `main` branch and all descendant branches.
+
+The pre-P07 `.gitignore` listed only `.env.local`, so `.env` was tracked.
+
+## Immediate Mitigations Applied in P07
+
+1. Added `.env` to `.gitignore` (matches `.env.local` discipline).
+2. Confirmed `scripts/backfill_releases.sh` does not echo the token, does
+   not pass it as a CLI argument to `tea`, and sources it from `.env` only.
+3. Confirmed `tea` is configured to use this token via its own config and
+   the script invokes `tea releases create` without `--token` flags.
+4. Documented the leak here for human review.
+
+## Required Human Actions (out of CI scope)
+
+1. **Rotate the Gitea token**: the leaked value is in the public-on-this-forge
+   git history. Treat it as compromised; generate a new token at
+   <https://git.cloudinit.dev/user/settings/applications> and update `.env`.
+2. **Rewrite history to scrub the secret** (optional but recommended):
+   - `git filter-repo --invert-paths --path .env` and force-push all
+     branches, OR
+   - use `git-filter-repo` via BFG Repo-Cleaner.
+   - This is a destructive operation; coordinate with all consumers.
+3. **Audit Gitea access logs** for the period the token was exposed to
+   detect any unauthorized use.
+4. **Add CI secret scanning**: integrate `gitleaks` or `trufflehog` into
+   the `validate` pipeline (deferred to v0.2 alongside REQ-014
+   `gosec`+`govulncheck`).
+
+## P07 Continues
+
+P07 EXECUTE continues (no P0 code change required for the milestone tag
+itself; the backfill script is safe and the existing token still works for
+its purpose). The P07 ship → v0.1 milestone → main flow proceeds, but
+REVIEW/AUDIT must flag this for the milestone close-out.
+
+## Forward-Looking Rule (proposed for v0.2)
+
+- `pre-commit` hook runs `gitleaks protect --staged` and rejects any
+  commit that adds a secret.
+- `.env*` is in `.gitignore` from the first commit of v0.2 onward.
+- `ciagent-init` warns loudly if `git log --all -- .env` returns anything.

.gitignore

@@ -8,5 +8,6 @@ orca
 *.db-journal
 *.db-wal
 *.db-shm
+.env
 .env.local
 *.tar.gz