Feature request: Sync repo/org secrets to local .env for local development

[xgboosted]

Problem

Developers working locally must manually copy secrets into .env. Error-prone. Painful at scale. Drift between CI and local dev.

Extension already lists secret names in "Secrets" and "Variables" views. Cannot bridge to local env.

Proposed solution

Add command: "GitHub Actions: Pull Secrets to .env"

1. Authenticate via existing GitHub login
2. Fetch secret names for current repo + environments (same scope as Secrets view)
3. Preview available secrets (names only)
4. On confirm, fetch decrypted values (workflow-execution approach or new API endpoint)
5. Write .env at workspace root (configurable)

Alternatives

Option	Gap
Manual .env	Current flow — time-consuming, drift-prone
act + secret file	Need values already local. No help sourcing
GitHub Codespaces	Auto-injects. But only for Codespaces, not local
gh extension	Separate tool, extra auth context

Constraints

• GitHub API does not expose secret plaintext (encrypted at rest by design)
• Needs either: new API endpoint OR one-time workflow that echoes base64-encoded secret values
• Solution parallel to how Codespaces injects secrets into the environment

Prior art

• Codespaces: already auto-injects secrets into dev environment. This request brings parity to local dev.
• "Context access might be invalid" warning thrown for repository variables and secrets #222 (500+ reactions): clear demand for improved secrets UX in extension

Success criteria

• Open local repo in VS Code → run "Pull Secrets to .env"
• GitHub auth (once) → see available secrets by scope
• Confirm → .env written at workspace root
• .env auto-.gitignore-d if absent