Fix Release workflow re-run failure; ignore .env

[fadeltd]

Why

The first real release run failed. The symptom pointed somewhere other than the cause, so it is worth writing down.

release.yml checked out github.sha — the commit that triggered the run — instead of the branch tip. What actually happened on merge of #1:

Attempt	What it did
1	Committed the changelog, pushed main successfully (b76e153), then did not reach the tag
2, 3	Re-ran from the now-stale trigger sha, committed on top of it, push rejected as non-fast-forward

The error read tip of your current branch is behind its remote counterpart, which looks like a race between jobs. It was not — the checkout had pinned an old base, so every retry was guaranteed to fail.

Current state on main: version is 0.2.0 and the changelog is correctly rolled over, but v0.2.0 was never tagged, so nothing deployed. The live site is still running the pre-ID-generator build.

Changes

• ref: main on checkout. Combined with the changelog logic already being idempotent — an empty [Unreleased] releases nothing — a re-run is now a no-op instead of a guaranteed failure.
• Each push is guarded separately. The old version pushed the branch and the tag in one unguarded sequence, so a failure between them left a state where every retry died on the first push and never reached the tag. Now a partially-completed attempt resumes.
• .env is gitignored. It is not tracked and never has been — I verified it returns 404 on the public remote — but the repo is public now and an untracked .env in the working tree is the classic accidental commit.

Merging this cuts v0.2.1

Dry run confirms: [Unreleased] has only ### Fixed → patch → 0.2.0 → 0.2.1. That tag will deploy, which also ships the ID generator, collapsible sidebar, GitHub link and focus-ring fix that are sitting on main undeployed.

Recovering v0.2.0

v0.2.0 has release notes on main but no tag. Either:

• push the tag by hand — git tag -a v0.2.0 <sha> && git push origin v0.2.0 — which deploys that commit and validates deploy.yml end to end before the next merge depends on it; or
• skip it and let this PR's v0.2.1 carry everything. v0.2.0 then simply never exists as a tag.

I have not done either — it is a production deploy, so it is your call.

Verification

• 330 tests pass; typecheck, lint and build clean.
• release.yml parses; pnpm exec vite-node scripts/release.ts --dry-run reports patch → v0.2.1.
• git check-ignore -v .env confirms the ignore rule matches.