Exclude paths ending in .env by default

[Boulea7]

Files such as keys.env pass the default filename filter and can reach provider request previews. Add .env to the existing case-insensitive sensitive suffixes, including directory components. --include-sensitive still opts in, while hidden-path rules and explicit excludes continue to apply.

Refs #51. This addresses the filename-suffix example; arbitrary configuration-file contents are not scanned for secret values.

Validated on Linux in Docker:

• Reproduced the regression in captured provider request payloads on current main, then verified the fix and six boundary tests.
• Type, lint, and formatting checks passed (lint retains one existing warning).
• Full suite: 239 passed; installed package: 41 passed, with no failures or skips.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T00:00:35.672173Z	132e27e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.