envkit v0.2.0 — easier manifest population

- add: accept multiple paths and --from <list> in one invocation
- init: scan ~ for common dotfiles and track the ones present (--no-scan to opt out)
- secret-bearing files are skipped with --secret guidance; --secret guarded to one file