feat(builder): load publish credentials from .env.builder

Keep DEB/Docker publish keys out of the project's .env. Scripts and
check.py --ready only read .env.builder; empty values count as missing.

skills/builder/templates/env.builder

@@ -0,0 +1,13 @@
+# Builder publish credentials. Copy to the project root as `.env.builder`.
+# Do not commit this file. Do not put these keys in the project's `.env`.
+# Uncomment and fill the keys for tracks this project uses.
+# Shell-exported values override this file.
+#
+# DEB_SERVER_URL=
+# DEB_TOKEN=
+# DEB_REPOSITORY=
+# DEB_UPLOAD_PATH=
+# DOCKER_REGISTRY=
+# DOCKER_REPOSITORY=
+# IMAGE_TAG=
+# PLATFORMS=