ci(risk-paths): exclude .env.example/template/sample from blocked glob

[topcoder1]

Summary

Fleet rollout of the fix shipped in whois-api-llc/wxa-graph#155. The blocked-glob **/.env* matched .env.example (a docs template), causing claude-author-automerge.yml to refuse PRs that added env-var documentation.

Replaces with explicit secrets-bearing variants:

• **/.env, **/.env.local, **/.env.development[.local], **/.env.production[.local], **/.env.staging[.local], **/.env.test[.local]

Documentation templates (.env.example, .env.sample, .env.template, .env.dist) now fall through to standard classification.

Auto-merge rationale

This PR ITSELF touches .github/risk-paths.yml which is in the blocked list (intentional — classifier-config changes deserve maintainer review). Manual click-merge expected. The fix lands for FUTURE PRs once merged.

Test plan

• YAML is valid
• Existing secret-bearing .env-style files still classified blocked (bare **/.env and named variants)
• .env.example no longer matches blocked

🤖 Generated with Claude Code

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12

[claude]

The explicit enumeration misses several common secrets-bearing variants that the old **/.env* glob caught. Real projects frequently use names like .env.prod, .env.dev, .env.ci, .env.qa, .env.uat, .env.preview, and .env.stg — files that are semantically secrets-bearing but spell out shorthand environment names rather than the full production/development/staging strings.

After this change, a PR that adds .env.prod with real credentials would classify as standard and could auto-merge, whereas before it would have been blocked.

Two options:

1. Add the common shorthands to the list (**/.env.prod, **/.env.dev, **/.env.ci, **/.env.qa, **/.env.uat, **/.env.stg, **/.env.preview).
2. Invert the logic in classify.mjs: block **/.env* by default, then in the classifier explicitly unclassify known-safe suffixes (.example, .sample, .template, .dist) back to standard. This is more robust but requires a code change to the script rather than just YAML.

Option 1 is the simpler fix for now, though it will always be an incomplete enumeration as new shorthand names appear. Option 2 closes the class of bypass permanently.

[claude]

Flagged 1 issue inline: the explicit env variant enumeration misses common shorthands (prod, dev, ci, qa suffixes) that are secrets-bearing but do not match the listed full-name variants, creating a bypass path vs. the original broad glob.