Prepare 0.1.0: one dotenv grammar, path policy, redactor, and safer writes

- parseDotenv, validate, and every edit share the round-trip document parser
- Path policy helpers (isEnvFile, isSensitiveEnvFile, isEnvSitterPepperFile) used by envsitter-guard
- CLI file commands run through the library file operations
- EnvSitter#redactor() and the redact command replace secret-looking values in text
- Writes keep file permissions and go through symlinks; new files are 0600
- An existing pepper is never replaced; a new .envsitter/ gets a .gitignore
- set/add/copy into empty files write clean output
- Regexes with g/y flags no longer skip keys
- TypeScript 6, Node 22+ engines, prepack build, dist/test excluded from the package

src/dotenv/document.ts

@@ -160,6 +160,8 @@ function parseAssignmentLine(raw: string, line: number, issues: DotenvIssue[]):
 
 export function parseDotenvDocument(contents: string): DotenvDocument {
   const issues: DotenvIssue[] = [];
+  if (contents.length === 0) return { lines: [], issues, endsWithNewline: true };
+
   const endsWithNewline = contents.endsWith('\n');
 
   const split = contents.split(/\r?\n/);
@@ -190,6 +192,7 @@ export function parseDotenvDocument(contents: string): DotenvDocument {
 }
 
 export function stringifyDotenvDocument(doc: DotenvDocument): string {
+  if (doc.lines.length === 0) return '';
   const out = doc.lines.map((l) => l.raw).join('\n');
   return doc.endsWithNewline ? `${out}\n` : out;
 }