feat(env-mapper): ship AI-safe env audit CI foundation

[obmakesomething]

What changed

• Repositioned Env Mapper as AI-safe Environment Config Audit instead of MCP-first tooling.
• Added not-a-secret-scanner messaging, comparison docs, limitations, and stronger security framing.
• Added versioned report metadata, top-level findings, per-variable findings, stable finding IDs, and package-included JSON schemas.
• Added config discovery for env-mapper.config.mjs and .env-mapper.json.
• Added include/exclude, public/secret classification overrides, ignored keys, allowed roots, and scan/output safety limits.
• Added env-mapper diff for baseline/current report or git-ref comparison.
• Added GitHub Action fail-on, baseline, output-format, json-output, annotations, max-findings, and count outputs.

Why

This makes Env Mapper usable as a redacted, read-only config audit layer for AI coding agents and CI adoption. Existing config debt can remain visible while new risky drift can fail PRs.

Validation

• npm test passed, 34/34
• npm run build passed
• npm run pack:check passed
• Manual smoke: scan report emits schema/hash/findings
• Manual smoke: diff against baseline report reports 0 new findings for unchanged fixture
• Manual smoke: Action fail-on=new-high passes with matching baseline and writes Markdown/JSON artifacts

Review gates

• Spec compliance review completed.
• Code quality/security review completed.
• Review findings fixed in b85e6d2:
  • line-shift baseline gates no longer count unchanged findings as new
  • Action JSON artifact now matches published GitHub audit schema shape
  • env templates respect include/exclude and maxFileBytes
  • maxOutputBytes is enforced with a clear failure

Non-goals

• No JS/TS AST scanner in this PR.
• No SARIF output in this PR.
• No provider mutation, secret creation, secret rotation, or secret value reads.
• No package/repo rename; env-mapper-mcp remains the package name for v0.2.

Risks / follow-ups

• Linear issue creation was skipped because the workspace hit the free issue limit.
• v0.3 follow-ups remain queued: JS/TS AST scanner, SARIF/code scanning, DMNO diff, provider adapter contract, LLM packet modes.

[devloai]

Unable to trigger custom agent "Code Reviewer". You have run out of credits 😔
Please upgrade your plan or buy additional credits from the subscription page.