fix(read): narrow .env file blocking to not block .envrc

[bukzor]

Summary

• Fix overly broad .env file blocking that was catching .envrc (direnv) and other legitimate files
• Changed from filepath.includes(".env") to basename-only regex /^\.env(\.|$)/
• Added .env.example and .env.template to whitelist
• Added test coverage for env file blocking behavior

Test plan

• [x] bun test test/tool/read.test.ts passes (7 tests)
• [ ] Manual test: can now read .envrc files
• [ ] Verify .env, .env.local, .env.production still blocked

Fixes #4969

🤖 Generated with Claude Code