harden export filtering and release versioning

[hyle]

Summary

Fix the issues around sensitive-file detection, recursive filesystem robustness, absolute stdin tree rendering, and release version stamping.

Changes

• Broaden sensitive filename protection to match the documented wildcard-style behavior for:
  • .env*
  • credentials*
  • secret*
  • id_rsa* and related key-name prefixes
• Make recursive filesystem export skip unreadable descendant directories with a warning instead of aborting the entire walk
• Preserve the leading / for absolute stdin paths in the project tree so the tree matches absolute file headings
• Pass the tag name into make in the release workflow so release binaries report the actual version instead of dev
• Extend CLI coverage for:
  • additional sensitive filename variants
  • unreadable descendant directories
  • absolute stdin paths in the tree
  • root-only skipping of the unreadable-file permission test

Why

These changes bring the implementation in line with the documented behavior, make recursive exports more resilient to partial filesystem access problems, keep the tree view consistent with exported headings, and ensure release artifacts report the correct version.

Verification

• Ran make test successfully
• Release-version wiring to try in CI