Feature request: Sync repo/org secrets to local .env for local development

未指定任何文件或测试。首先跟踪现有的 Secrets 和 Variables 视图以及 GitHub 登录流程，然后验证是否安全支持所提议的 secret 值检索。完成的标准是：该命令预览作用域内的 secret 名称，在写入 workspace 根目录下的 .env 前进行确认，并在 .gitignore 不存在时将其添加进去。

Problem

Developers working locally must manually copy secrets into .env. Error-prone. Painful at scale. Drift between CI and local dev.

Extension already lists secret names in "Secrets" and "Variables" views. Cannot bridge to local env.

Proposed solution

Add command: "GitHub Actions: Pull Secrets to .env"

1. Authenticate via existing GitHub login
2. Fetch secret names for current repo + environments (same scope as Secrets view)
3. Preview available secrets (names only)
4. On confirm, fetch decrypted values (workflow-execution approach or new API endpoint)
5. Write .env at workspace root (configurable)

Alternatives

Constraints

• GitHub API does not expose secret plaintext (encrypted at rest by design)
• Needs either: new API endpoint OR one-time workflow that echoes base64-encoded secret values
• Solution parallel to how Codespaces injects secrets into the environment

Prior art

• Codespaces: already auto-injects secrets into dev environment. This request brings parity to local dev.
• #222 (500+ reactions): clear demand for improved secrets UX in extension

Success criteria

• Open local repo in VS Code → run "Pull Secrets to .env"
• GitHub auth (once) → see available secrets by scope
• Confirm → .env written at workspace root
• .env auto-.gitignore-d if absent