feat(builder): load publish credentials from .env.builder

Keep DEB/Docker publish keys out of the project's .env. Scripts and
check.py --ready only read .env.builder; empty values count as missing.

skills/builder/scripts/check.py

@@ -43,6 +43,7 @@ FLOATING_TAGS = (":latest", ":stable")
 DEB_SHAPE = re.compile(r"^[^_\s]+_[^_\s]+_[^_\s]+\.deb$")
 VALID_SCRIPT_NAMES = ("upload_deb.sh", "publish_docker.sh")
 BUILDER_MAKEFILE = "makefile.builder"
+BUILDER_ENV = ".env.builder"
 
 PASS = "PASS"
 FAIL = "FAIL"
@@ -279,12 +280,12 @@ def check_secrets_and_tags(report: Report, project: Path) -> None:
 
 DEB_ENV_KEYS = ("DEB_SERVER_URL", "DEB_TOKEN", "DEB_REPOSITORY")
 DOCKER_ENV_KEYS = ("DOCKER_REGISTRY",)
-ENV_KEY_LINE = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=")
+ENV_KEY_LINE = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=(.*)$")
 
 
 def env_file_keys(project: Path) -> set[str]:
-    """Return key names defined in project `.env`. Never return or print values."""
-    path = project / ".env"
+    """Return nonempty key names in `.env.builder`. Never return or print values."""
+    path = project / BUILDER_ENV
     keys: set[str] = set()
     if not path.is_file():
         return keys
@@ -297,7 +298,10 @@ def env_file_keys(project: Path) -> set[str]:
         if not stripped or stripped.startswith("#"):
             continue
         match = ENV_KEY_LINE.match(stripped)
-        if match:
+        if not match:
+            continue
+        value = match.group(2).strip().strip("'\"")
+        if value:
             keys.add(match.group(1))
     return keys
 
@@ -364,9 +368,9 @@ def check_ready_env_keys(
         lines.extend(
             [
                 "",
-                "blocks publish, not build. Put keys in the environment or project `.env`:",
+                f"blocks publish, not build. Put keys in the environment or {BUILDER_ENV}:",
                 *[f"  {key}=" for key in missing],
-                "Do not commit `.env`. Never print values.",
+                f"Do not commit {BUILDER_ENV}. Do not put these keys in `.env`. Never print values.",
             ]
         )
         report.add(SKIP, 11, "发布环境变量键名（不读取值）", "\n".join(lines))