build: harden just publish with token lookup and dry run

- Move token lookup into scripts/pypi_token.sh, shared by both recipes
- Resolve UV_PUBLISH_TOKEN, then .env, then pass api/packages/pypi
- Fail with a clear hint instead of dropping into an interactive prompt
- Never print the token, only its length
- Gate publish behind version-check so version drift stops the build
- Add publish-dry, same path as publish but with uv publish --dry-run
- Pass --check-url so re-runs skip files already on PyPI
- Hoist dist dir, token entry, and check URL into justfile variables
- Add .env and .env.* to .gitignore

The old recipe sourced .env for credentials, but .env was never ignored, so a token file dropped there would have been committed and shipped inside the sdist.

Verified token precedence for env, .env and password-store, the missing-token exit code, the version-check gate, and a dry run against an unpublished version.

justfile

@@ -4,6 +4,11 @@
 # Default browser profile for `install` / quick checks
 browser := "brave"
 
+# Where `publish` builds, and where it looks up the PyPI token
+dist_dir := "/tmp/dist-browser-cli"
+pypi_token_entry := "api/packages/pypi"
+pypi_check_url := "https://pypi.org/simple/"
+
 # Show available recipes
 default:
     @just --list
@@ -74,17 +79,27 @@ version-check:
      ext=$(grep -m1 '"version"' extension/manifest.json | cut -d'"' -f4); \
      if [ "$py" = "$ext" ]; then echo "ok: $py"; else echo "MISMATCH pyproject=$py manifest=$ext"; exit 1; fi
 
-# Build into /tmp/dist-browser-cli and publish using credentials from .env
-publish:
+# Build and upload to PyPI. Token: UV_PUBLISH_TOKEN, else .env, else password-store.
+publish: version-check
     #!/usr/bin/env bash
     set -euo pipefail
-    set -a
-    [ ! -f .env ] || source .env
-    set +a
-    rm -rf /tmp/dist-browser-cli
-    mkdir -p /tmp/dist-browser-cli
-    uv build --out-dir /tmp/dist-browser-cli
-    uv publish /tmp/dist-browser-cli/*
+    source scripts/pypi_token.sh
+    load_pypi_token "{{pypi_token_entry}}" || exit 1
+    rm -rf "{{dist_dir}}"
+    mkdir -p "{{dist_dir}}"
+    uv build --out-dir "{{dist_dir}}"
+    uv publish --check-url "{{pypi_check_url}}" "{{dist_dir}}"/*
+
+# Same build and token path as `publish`, but uploads nothing
+publish-dry: version-check
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source scripts/pypi_token.sh
+    load_pypi_token "{{pypi_token_entry}}" || exit 1
+    rm -rf "{{dist_dir}}"
+    mkdir -p "{{dist_dir}}"
+    uv build --out-dir "{{dist_dir}}"
+    uv publish --dry-run --check-url "{{pypi_check_url}}" "{{dist_dir}}"/*
 
 # ── Demos ──────────────────────────────────────────────────────────────