Add layered environment model and taskfile composition rules

Fold two overlapping local skills (scripts-shell, shell-scripts-module)
into this one, keeping only what it did not already cover.

- Add references/environment-model.md: the three-layer .env selector model,
  why set -a dot-sourcing beats export $(grep|xargs), tracked samples, the
  no-re-sourcing rule for module readers, and the deployment boundary
  (repo-presence is not git-tracked is not deployed).
- Extend references/taskfile.md with the one-env-driven-task rule (no
  :default pairs) and composing commands through the task surface.
- Add the lifecycle-hook module type to references/module-patterns.md.
- Keep this skill's _moduleExampleV1_ naming as canonical; the retired
  skills' HL_V1_ and double-underscore dialects were not carried over.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

SKILL.md

@@ -36,6 +36,7 @@ Pick the reference that matches the change; do not load all of them.
 |---|---|
 | A reader, validator, implementation function, or `api/` wrapper | `references/module-anatomy.md` |
 | The `loggers` or `base` module, or logging that produces no output | `references/shared-modules.md` |
+| `.env` files, per-environment layers, or shipping `.scripts/` into a rendered repo | `references/environment-model.md` |
 | A module `Taskfile.yml` or the root `Taskfile.yml` | `references/taskfile.md` |
 | Creating a module, changing one, or checking work before delivery | `references/workflows.md` |
 | Deciding what kind of module something should be | `references/module-patterns.md` |
@@ -145,7 +146,8 @@ command (`-name.sh`) or wires the module together (`--name.sh`).
 - **Every new `lib/-*.sh` gets added to `lib/--index-api.sh`.** Forgetting this is the most
   common cause of "command not found" for a function that plainly exists.
 - **Readers preserve already-exported values** — `export X="${X:-default}"` — so a caller can
-  override any setting before invoking the module.
+  override any setting before invoking the module. A module reader never sources `.env` files
+  itself; the `base` module owns that. See `references/environment-model.md`.
 - **Log through `_loggers_*` helpers, never raw `echo`.** Loggers write to `stderr`, keeping
   `stdout` clean for real output.
 - **Never log secrets.** Redact tokens, API keys, passwords, and kube config.