release: v4.2.0 — Entra directory role membership export

- Add Scripts/Export-EntraRoleMembership.ps1 to export active + PIM-eligible
  Entra directory role memberships (with group expansion) to CSV.
- Wire the new script into Start-IntuneToolkit.ps1 as menu item 20.
- Document the new script in README.md and AGENTS.md.
- Bump VERSION to 4.2.0 and add CHANGELOG entry.
- Harden .gitignore against local operational artifacts (accounts/ folder,
  deploy.sh, restart_gateways.sh).

Start-IntuneToolkit.ps1

@@ -308,6 +308,7 @@ $commonParams = @{
 }
 
 $menuItems = @(
+    "20. Export Entra role membership"
     "19. Document Conditional Access policies"
     "18. Rotate app secret"
     "17. Deploy CIS M365 baseline"
@@ -514,6 +515,22 @@ while($true)
         continue
     }
 
+    if($choiceNumber -eq 20)
+    {
+        $roleScript = Join-Path $projectRoot "Scripts/Export-EntraRoleMembership.ps1"
+        $roleParams = @{ TenantId = $TenantId; AuthMode = $AuthMode }
+        if($AppId) { $roleParams.AppId = $AppId }
+        if($Secret) { $roleParams.Secret = $Secret }
+        elseif($Certificate) { $roleParams.Certificate = $Certificate }
+        if($SettingsFile) { $roleParams.SettingsFile = $SettingsFile }
+        $csvOut = Read-Host "CSV output path (Enter for default: <TenantName>-Entra-AllRoleMemberships.csv)"
+        if(-not [string]::IsNullOrWhiteSpace($csvOut)) { $roleParams.CsvPath = $csvOut }
+        & $roleScript @roleParams
+        Write-Host "`nPress any key to return to the menu..." -ForegroundColor DarkGray
+        $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
+        continue
+    }
+
     if($choiceNumber -eq 19)
     {
         $caScript = Join-Path $projectRoot "Scripts/Invoke-ConditionalAccessDocumentation.ps1"