.envrc contains shared direnv/Nix setup (no secrets). Local overrides and secrets belong in .envrc.local, which is now gitignored.