fix: harden frontend dependency and env hygiene

scripts/repository-hygiene-check.mjs

@@ -0,0 +1,44 @@
+import { execFileSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+function git(args) {
+	return execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
+}
+
+function isIgnored(file) {
+	try {
+		execFileSync("git", ["check-ignore", "--no-index", "-q", file], {
+			cwd: root,
+			stdio: "ignore",
+		});
+		return true;
+	} catch (error) {
+		if (error.status === 1) return false;
+		throw error;
+	}
+}
+
+function assert(condition, message) {
+	if (!condition) throw new Error(message);
+}
+
+const trackedEnvironmentFiles = git(["ls-files", "--", ".env", ".env.*"])
+	.split("\n")
+	.filter(Boolean)
+	.sort();
+
+assert(
+	JSON.stringify(trackedEnvironmentFiles) === JSON.stringify([".env.example"]),
+	`Only .env.example may be tracked; found: ${trackedEnvironmentFiles.join(", ") || "none"}`,
+);
+
+for (const file of [".env", ".env.local", ".env.development", ".env.test"]) {
+	assert(isIgnored(file), `Local environment file must be ignored: ${file}`);
+}
+
+assert(!isIgnored(".env.example"), ".env.example must remain versionable");
+
+console.log("Frontend repository hygiene verified");