doctor: warn when .env exists but is not gitignored

[SAY-5]

Closes #39. Extends doctor's existing .gitignore check to recognize wildcard patterns (*.env, **/.env, .env*, etc.) by delegating to git check-ignore when a repo is present, and falling back to a broader text scan otherwise. Adds five unit tests covering exact-match, wildcard, double-star glob, missing-entry, and comment-only fallback cases.

[vercel]

Someone is attempting to deploy a commit to the Evero Team on Vercel.

A member of the Team first needs to authorize it.

[SAY-5]

The Ignored Tests job failures (cloud_pull_handles_404_gracefully, cloud_push_calls_vault_push_endpoint, cloud_push_then_pull_round_trip) are pre-existing failures on main, not regressions introduced by this PR. They reproduce on the most recent successful main-branch CI runs (e.g. workflow run 25302582843) with the same "Authentication required. Run phantom login first." panic.

This PR's change is limited to crates/phantom-cli/src/commands/doctor.rs (the .gitignore wildcard check), which is unrelated to the cloud_test.rs integration suite. The Lint and Test (ubuntu/macos/windows) jobs that exercise the actual change all pass.

(The Vercel deploy failure is a fork-PR auth boundary, same on every fork PR.)