feat(builder): load publish credentials from .env.builder

Keep DEB/Docker publish keys out of the project's .env. Scripts and
check.py --ready only read .env.builder; empty values count as missing.

skills/builder/scripts/upload_deb.sh

@@ -15,9 +15,9 @@ Options:
   -p UPLOAD_PATH      Override DEB_UPLOAD_PATH (default: /api/v2/upload/package)
   -h                  Show help
 
-Environment variables may live in the project root .env; this script walks up
-from the current directory, loads it silently (existing shell values win), and
-never echoes variable values. The endpoint must accept multipart fields named
+Environment variables may live in the project root .env.builder; this script
+loads it silently (existing shell values win), never echoes values, and does
+not read `.env`. The endpoint must accept multipart fields named
 package, token, and repository_name. Authentication is read only from
 DEB_TOKEN so it is not exposed in the process command line.
 
@@ -25,21 +25,22 @@ The working tree must be clean to publish; set ALLOW_UNCOMMITTED=1 to override.
 EOF
 }
 
-# Locate project root (.git) upward from cwd for .env loading and git checks.
+# Locate project root (.git) upward from cwd for .env.builder loading and git checks.
 project_root=$(git rev-parse --show-toplevel 2>/dev/null || true)
 
-# Load project .env without printing values; explicitly exported shell values keep precedence.
-if [[ -n "$project_root" && -f "$project_root/.env" ]]; then
+# Load .env.builder without printing values; shell values win. Do not read `.env`.
+if [[ -n "$project_root" && -f "$project_root/.env.builder" ]]; then
   while IFS='=' read -r key value; do
     key=${key%%[[:space:]]*}
     [[ -z "$key" || "$key" == \#* ]] && continue
     if [[ -n "${!key:-}" ]]; then
-      continue  # shell value already set: wins over .env
+      continue  # shell value already set: wins over .env.builder
     fi
     value=${value%\"}; value=${value#\"}; value=${value%\'}; value=${value#\'}
+    [[ -z "$value" ]] && continue
     printf -v "$key" '%s' "$value"
     export "$key"
-  done < <(grep -v '^[[:space:]]*$' "$project_root/.env")
+  done < <(grep -v '^[[:space:]]*$' "$project_root/.env.builder")
 fi
 
 server_url=${DEB_SERVER_URL:-}
@@ -61,7 +62,7 @@ shift $((OPTIND - 1))
 
 if [[ -z "$server_url" || -z "$repository" || -z "$token" || $# -eq 0 ]]; then
   echo "Error: DEB_SERVER_URL, DEB_TOKEN, DEB_REPOSITORY, and at least one file are required." >&2
-  echo "Set them in the environment or the project root .env." >&2
+  echo "Set them in the environment or the project root .env.builder." >&2
   usage >&2
   exit 2
 fi