How to prevent Google Antigravity from accessing .env

How to deny Google Antigravity's agent access to your .env in the IDE and the CLI, how to verify it worked, and the settings around it that matter.