fix(security): untrack .env — secret in history, rotate forward

The .env file (containing GITEA_TOKEN) was committed in 0cba1aa during
P00 and remained tracked in git history despite the leak. The
.gitignore addition in 477b08c (P07) prevents future re-tracking but
does not untrack a file already in the index.

This commit runs 'git rm --cached .env' to remove the file from the
index while preserving the working-tree copy (which now contains the
rotated token post-P07-verify). The secret remains in git history at
0cba1aa and must be scrubbed by a human (see PHASE7_SECURITY_AUDIT.md
for the full remediation plan, including optional git-filter-repo
history rewrite).

Combined with 477b08c, this commit closes the forward-fix loop:
- .env is now ignored (.gitignore)
- .env is no longer tracked (this commit)
- New tokens in .env will not be committed accidentally
- The historical leak is documented for human remediation

---ci---
project: orca
phase: 7
milestone: v0.1
status: ship
version: v0.1.7
requirements:
  covered: [REQ-007]
  partial: []
---/ci---

.env

@@ -1,2 +0,0 @@
-GITEA_TOKEN=795e2f875dcd23dff830fab8301ec52e4c9d67aa
-GITEA_USER=cloudinit-bot