release: v4.2.0 — Entra directory role membership export

- Add Scripts/Export-EntraRoleMembership.ps1 to export active + PIM-eligible
  Entra directory role memberships (with group expansion) to CSV.
- Wire the new script into Start-IntuneToolkit.ps1 as menu item 20.
- Document the new script in README.md and AGENTS.md.
- Bump VERSION to 4.2.0 and add CHANGELOG entry.
- Harden .gitignore against local operational artifacts (accounts/ folder,
  deploy.sh, restart_gateways.sh).

CHANGELOG_macOS_IntuneToolkit.md

@@ -1,5 +1,26 @@
 # macOS Intune Toolkit Changelog
 
+## 2026-06-23 — v4.2.0 — Entra directory role membership export
+
+### Added
+- **`Scripts/Export-EntraRoleMembership.ps1`**
+  - Exports all active and PIM-eligible Microsoft Entra directory role memberships to CSV.
+  - Expands group-assigned roles to transitive group members.
+  - Marks whether each role is privileged.
+  - Supports the toolkit's standard `-AuthMode` (`AppOnly`, `Browser`, `DeviceCode`) and reads saved credentials from `Settings.json`/macOS Keychain.
+
+- **`Start-IntuneToolkit.ps1`**
+  - Added menu item **20. Export Entra role membership** that launches the new script and prompts for the CSV output path.
+
+- **`README.md`**
+  - Listed `Scripts/Export-EntraRoleMembership.ps1` in the entry points and documented its purpose.
+
+### Repository hygiene
+- **`.gitignore`**
+  - Ignore the local `accounts/` folder and stray operational shell scripts (`deploy.sh`, `restart_gateways.sh`).
+
+---
+
 ## 2026-06-22 — Expanded settings report coverage and Conditional Access documentation
 
 ### Added