feat: add /env-check — validate .env.example completeness and detect hardcoded secrets

### /env-check — Environment variable audit skill

Env var drift is one of those quiet problems that bites you at deployment time. Would be nice to have a `/env-check` skill that:

1. Compares `.env.example` vs `.env` (or equivalent) and flags keys present in one but not the other
2. Scans source files for hardcoded strings that look like secrets (API key patterns, connection strings, tokens)
3. Checks that env vars referenced in code (`process.env.X`, `os.getenv('X')`) are documented in `.env.example`

**Use case:** Run before `/ship` to catch accidental secret commits or undocumented env dependencies before they reach CI.

**Possible approach:** Pattern matching on common secret formats (base64-looking strings of 20+ chars, strings starting with `sk-`, `ghp_`, etc.) combined with a `.env.example` diff. Probably a 100-line Python/Node script that Claude can run directly.

I see gstack already has `/cso` for security audits — this could either be a standalone skill or an addition to that flow.