fix: pass --env-file to docker compose so .env is actually read

docker compose -f infra/docker-compose.yml sets the project directory
to infra/, so it looks for .env in infra/.env (which doesn't exist).
The .env at workspace root was never read — all ${VAR:-default}
substitutions in docker-compose.yml silently used hardcoded defaults.

This is why M87_BOOTSTRAP_KEY always resolved to "m87-dev-key-change-me"
inside the container regardless of what .env contained.

Fix: --env-file .env explicitly points docker compose at the workspace
root .env file.

https://claude.ai/code/session_01DAuwxwQQoyHFHbmumedqob

Author: claude

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
 
       - name: Start services
         run: |
-          docker compose -f infra/docker-compose.yml up -d --build
+          docker compose --env-file .env -f infra/docker-compose.yml up -d --build
           sleep 10
 
       - name: Wait for API health