[Mate] Add symfony-dotenv-check tool for safe .env inspection

[wachterjohannes]

Q	A
Bug fix?	no
New feature?	yes
Docs?	yes
Issues	n/a
License	MIT

Problem

bin/console debug:dotenv prints every resolved env var fully unmasked. During local Mate testing this leaked a genuine HUGGINGFACE_API_KEY into an agent transcript, sourced from the ambient shell rather than any project file. Mate had no tool of its own covering env/dotenv, despite a misconfigured .env being one of the most common causes of a broken setup.

What this adds

A new symfony-dotenv-check tool, active only when symfony/dotenv is installed. It mirrors Symfony's own Dotenv::loadEnv() discovery order (.env/.env.dist → .env.local → .env.$APP_ENV → .env.$APP_ENV.local) and reports, per variable: which file(s) declare it, whether it resolves in Mate's own process, and a state (file, ambient_override, ambient_only, declared_empty_in_file, declared_not_resolved_in_this_process, not_set). ambient_override is exactly the shape of the original leak: declared as a placeholder in .env, but the real value comes from somewhere else entirely.

Masking (never a raw value)

Every value reduces to length (real count, shown openly) and a fixed-width preview mask (first+last character, or ** for very short values) plus a content-based looks_like_placeholder guess. Values are masked uniformly regardless of key name — no allowlist for "safe" keys like APP_ENV. That kind of per-key heuristic is exactly what let the original leak through unnoticed.

Uses plain ResponseEncoder::encode(), not encodeUntrusted() — same reasoning as server-info: these are measured facts about the project/environment, not attacker-influenced application data.

Docs & tests

New symfony-dotenv-diagnostics skill, INSTRUCTIONS.md section, CHANGELOG.md entry in a new 0.14 section (0.13 is frozen since v0.13.0). Tests cover file precedence, .env.dist fallback, empty/ambient/override states, uniform masking, placeholder detection, and an explicit "no raw secret in output" assertion. vendor/bin/phpunit, phpstan analyse --debug, php-cs-fixer fix: all green.