[bug] push refuses the env files env add leaves in a standalone clone

[SaulMoro]

Description

In a standalone team clone, env add then push fails. The env edit never gets published.

teamai env add KEY …      writes env/env.yaml (or env/secrets.yaml) in the clone, uncommitted
teamai push --all
  guard: dirty paths?      only .teamai/.sync-lock and teamai.yaml are exempt   (src/push.ts:345-359)
  ✖ stops here             "Cannot push: the team repo has uncommitted changes"
  resetToCleanMaster
  pullRepo
  sweep env/ → commit      never reached

Expected: push commits the env file, as it did before #690. Single-repo mode isn't affected.

Proposed fix, the way push already handles teamai.yaml. The exempt set is whatever EnvHandler.scanLocalForPush would push, so env/secrets.yaml from #880 is covered without a second list:

 push
+  pending = capture dirty files EnvHandler.scanLocalForPush lists   # env.yaml today, + secrets.yaml with #880
-  unsafe  = dirty paths − {sync-lock, teamai.yaml}
+  unsafe  = dirty paths − {sync-lock, teamai.yaml} − pending
-  resetToCleanMaster; pullRepo
+  try { resetToCleanMaster; pullRepo } finally { write pending back }
   sweep env/ → commit

The write-back sits in a finally: writing it back only after a successful pullRepo would lose the edit when the pull fails after reset --hard.

Plus a regression test: env add then push on a standalone clone, and the pushed branch carries the change.

Reproduction

1. A standalone team clone, e.g. a sandbox HOME and a local bare repo behind a synthetic https URL (url.<bare>.insteadOf, as src/__tests__/e2e/init-project-all.test.ts does), then teamai init <url>.
2. teamai env add TEAM_VAR changed (or teamai env add GITHUB_TOKEN --secret on the Proposal: declare team secrets in the repo, keep their values on each machine, for MCP servers and CLIs #875 branch).
3. teamai push --all.

Environment

• OS: macOS 27.0
• Node.js: v24.21.0
• teamai: 0.22.0 (main at 5fb316c) and the feat(env): team-declared secrets with member-local values (#875) #880 branch
• Provider: generic git (local fixture)
• AI tool(s): none needed

Logs

Captured on the #880 branch with env add --secret

$ teamai push --all
- Pulling latest changes...
✖ Cannot push: the team repo has uncommitted changes. Commit or stash them first. Paths: env/secrets.yaml
exit=1

The plain env add TEAM_VAR changed case (path env/env.yaml) was reported by the implementer who found it and follows from the same guard; its output isn't captured here.

Found while implementing #879.