Feature request: Sync repo/org secrets to local .env for local development

未指定任何檔案或測試。先追蹤現有的 Secrets 和 Variables 檢視畫面以及 GitHub 登入流程，然後確認是否能安全支援所提議的 secret 值擷取。完成條件是：該指令預覽範圍內的 secret 名稱，在寫入 workspace 根目錄的 .env 前要求確認，並在 .gitignore 不存在時將其加入。

Problem

Developers working locally must manually copy secrets into .env. Error-prone. Painful at scale. Drift between CI and local dev.

Extension already lists secret names in "Secrets" and "Variables" views. Cannot bridge to local env.

Proposed solution

Add command: "GitHub Actions: Pull Secrets to .env"

1. Authenticate via existing GitHub login
2. Fetch secret names for current repo + environments (same scope as Secrets view)
3. Preview available secrets (names only)
4. On confirm, fetch decrypted values (workflow-execution approach or new API endpoint)
5. Write .env at workspace root (configurable)

Alternatives

Constraints

• GitHub API does not expose secret plaintext (encrypted at rest by design)
• Needs either: new API endpoint OR one-time workflow that echoes base64-encoded secret values
• Solution parallel to how Codespaces injects secrets into the environment

Prior art

• Codespaces: already auto-injects secrets into dev environment. This request brings parity to local dev.
• #222 (500+ reactions): clear demand for improved secrets UX in extension

Success criteria

• Open local repo in VS Code → run "Pull Secrets to .env"
• GitHub auth (once) → see available secrets by scope
• Confirm → .env written at workspace root
• .env auto-.gitignore-d if absent