fix: load ./.env only when private and owned, add --env-file and AEGIS_ENV_FILE (SEC-04)

tests/test_config.py

@@ -91,7 +91,9 @@ def test_env_names_are_case_insensitive(monkeypatch: pytest.MonkeyPatch) -> None
 
 
 def test_reads_dotenv_file(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
-    (tmp_path / ".env").write_text("GITEA_URL=https://dotenv.example.com\nREAD_ONLY=true\n")
+    dotenv = tmp_path / ".env"
+    dotenv.write_text("GITEA_URL=https://dotenv.example.com\nREAD_ONLY=true\n")
+    dotenv.chmod(0o600)  # an implicit ./.env is only trusted with mode 0600 (SEC-04)
     reset_settings()
     settings = get_settings()