feat(security): apply phase 2 system hardening patch

fix: anchor env/ in gitignore to prevent excluding src/env package