Ignore hidden entries during secrets bootstrap

secrets.go

@@ -88,6 +88,7 @@ func (e *SecretsError) Diagnostics() []Diagnostic {
 // LoadSecretsDir explicitly loads immediate regular files from directory into
 // previously unset process environment variables. Applications should call it
 // once during startup, before concurrent work; Load never calls it.
+// Dot-prefixed entries are ignored and omitted from the report.
 func LoadSecretsDir(directory string) (*SecretsReport, error) {
 	report, err := engine.LoadSecretsDir(directory)
 	result := &SecretsReport{value: report}