Action Env Secret Sync

GitHub Action that validates .env.example matches actual GitHub Secrets and warns on drift.