GeezerVison

What changed

• stop tracking the root and OpenDataDiscovery .env files
• ignore local .env variants while keeping .env.example files trackable
• add value-free examples containing the same variable names as the local files

Why

The public repository tracked environment files containing password and secret fields. Local runtime configuration must stay outside Git, with only value-free templates committed.

Impact

Existing local .env files remain on disk and continue to drive local Docker Compose commands. New checkouts must copy the relevant .env.example and supply their own values.

Validation

• both local .env files remain present with owner-only permissions
• example variable-name sets exactly match their corresponding local files
• examples contain zero non-empty values
• git diff --check passes
• Compose parsing passes for docker-compose.dev.yml, DataHub, Airflow/DataHub, and OpenDataDiscovery
• root docker-compose.yml still has a pre-existing unrelated error: tabix depends on undefined service clickhouse

Security follow-up

This PR does not rewrite Git history or invalidate exposed credentials. Rotate the custom LIGHTDASH_SECRET, OpenDataDiscovery PostgreSQL password, and ClickHouse password before treating the exposure as resolved.