feat(builder): load publish credentials from .env.builder

Keep DEB/Docker publish keys out of the project's .env. Scripts and
check.py --ready only read .env.builder; empty values count as missing.

skills/builder/scripts/publish_docker.sh

@@ -6,8 +6,8 @@ usage() {
 }
 
 # Build and publish a Docker image with buildx. Configuration comes from the
-# environment first (optionally loaded from the project root .env); flags
-# override.
+# environment first (optionally loaded from the project root .env.builder);
+# flags override. Does not read `.env`.
 #
 # Usage:
 #   publish_docker.sh [--registry HOST] [--repository PATH] [--tag TAG] \
@@ -30,18 +30,19 @@ usage() {
 
 project_root=$(git rev-parse --show-toplevel 2>/dev/null || true)
 
-# Load project .env without printing values; explicitly exported shell values keep precedence.
-if [[ -n "$project_root" && -f "$project_root/.env" ]]; then
+# Load .env.builder without printing values; shell values win. Do not read `.env`.
+if [[ -n "$project_root" && -f "$project_root/.env.builder" ]]; then
   while IFS='=' read -r key value; do
     key=${key%%[[:space:]]*}
     [[ -z "$key" || "$key" == \#* ]] && continue
     if [[ -n "${!key:-}" ]]; then
-      continue  # shell value already set: wins over .env
+      continue  # shell value already set: wins over .env.builder
     fi
     value=${value%\"}; value=${value#\"}; value=${value%\'}; value=${value#\'}
+    [[ -z "$value" ]] && continue
     printf -v "$key" '%s' "$value"
     export "$key"
-  done < <(grep -v '^[[:space:]]*$' "$project_root/.env")
+  done < <(grep -v '^[[:space:]]*$' "$project_root/.env.builder")
 fi
 
 git_repo_name=
@@ -81,7 +82,7 @@ if [[ -n "$registry" && ( "$registry" == *://* || "$registry" == */* ) ]]; then
 fi
 if [[ -z "$registry" ]]; then
   echo "Error: DOCKER_REGISTRY (or --registry) is required." >&2
-  echo "Set it in the environment or the project root .env." >&2
+  echo "Set it in the environment or the project root .env.builder." >&2
   usage >&2
   exit 2
 fi