feat: add --env-file / -e flag for secret injection (Issue #23)

[seanseannery]

Key Changes

• New -e / --env-file <path> flag loads secrets from a .env-format file at invocation time without committing them to the Opsfile or pre-exporting them in the shell
• Auto-loads .ops_secrets.env from the Opsfile directory when no -e flag is given (silent no-op if absent); explicit -e replaces the default, not stacks with it
• Updated 6-level variable resolution priority (shell env wins, matching Docker Compose / Terraform convention): shell env-scoped → Opsfile env-scoped → env-file env-scoped → shell unscoped → Opsfile unscoped → env-file unscoped
• --help documents that -e must appear before positional arguments, and that --dry-run will expose injected secret values

Why do we need this?

Opsfile variables are committed to the repo for non-sensitive config, but many operational commands require secrets (AWS tokens, DB passwords, API keys) that cannot be committed. Previously operators had to pre-export these manually in their shell session. This flag lets them point ops at a .env file at invocation time. Closes #23.

New modules or other dependencies introduced

None. internal/envfile_parser.go reuses the existing extractVariableValue helper from opsfile_parser.go. No external dependencies added.

How was this tested?

• 6 new ParseEnvFile unit tests: quoting (single/double), comments, blank lines, env-scoped keys, empty-name error, file-not-found, directory path, Windows \r\n line endings, exact error format
• 8 new flag parser tests: -e short/long/= syntax, duplicate flag error, missing arg error, combined with other flags, --help output assertions
• Full 6-level priority chain tested via table-driven TestResolveVar_PriorityChain (p1–p6) plus boundary tests (env-file-scoped beats opsfile-unscoped, env-scoped key wrong-env)
• 3 existing resolver tests corrected to reflect new shell-wins priority order
• .ops_secrets.env auto-load, silent-skip, and bypass-when-explicit tested in cmd/ops integration path
• All 132 tests pass, lint clean