CB-581: neutralise the parityOverlay false-preserve risk, and record the rule

Issue #57 criterion 5 asked for an explicit decision on this rather than
silence. It is closer to live than the issue assumed.

The DEFAULT parityOverlay is List.of(".env", ".envrc"), so it applies to every
profile, and neither path was gitignored. Since CB-576 a release preserves any
worktree that git status --porcelain calls dirty, and that deliberately counts
untracked files — the work lost in CB-576 was a file nobody had added. So one
.env at the repo root would make every COMPLETED release preserve its
worktree, and worktrees would accumulate with no error to notice.

Inert today only because neither file exists here. Both are now gitignored,
which they deserve on their own as environment files. The javadoc carries the
rule for the next overlay path: it must be gitignored, or tracked and
skip-worktree'd.

.gitignore

@@ -6,6 +6,14 @@
 # Settings backups inherit the env block — and secrets with it.
 .claude/settings.local.json.bak*
 
+# The default profile parityOverlay copies these primary→worktree, so they appear in EVERY worker
+# worktree. Two reasons they must be ignored. They hold environment values, which is reason enough.
+# And since CB-576 a release preserves any worktree that `git status --porcelain` calls dirty —
+# untracked files included, deliberately. An untracked overlay file would therefore make every
+# COMPLETED release preserve its worktree, and worktrees would pile up with no error to notice.
+.env
+.envrc
+
 # Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
 # repo root and bridged/ collect one; neither belongs in git.
 bridged.out