v2.0.6 — fewer false .env denials

Castra guardian: .env reads are judged by the file a command opens.

The vendored guardian denied any command where a word like grep, open or type was followed anywhere by .env, in every permission mode. It blocked git grep "process.env…", file-name checks such as ls | grep -c '^\.env', handover scripts whose text mentions .env.local, and even node --input-type=… lines.

It now looks at the file arguments of reading commands (cat, head, tail, less, bat, grep, rg, PowerShell Get-Content/gc/type):

• Still handed off: reading a .env file directly, inside $(…) or backticks, inside bash <<'SH' bodies, or through Python open('.env…').
• No longer denied: process.env / import.meta.env searches, file-name checks, and .env mentioned in here-document text.

On the author's real history, 95 of 115 denials now pass; the remaining 20 are direct reads of .env files. Counting lines or names in a .env file (grep -c) and reading .env.example stay handed off, as before.