Stop tracking fiction, and stop carrying 80 MiB of wallpaper per clone

Three things were in history that should not have been, all invisible to the
tool that deploys them:

- `home/dank/.omp/dotfiles/**` — 3 files re-hosting `niri/cfg/autostart.kdl`,
  `niri/cfg/keybinds.kdl` and `systemd-user/…/swayidle-lock.service` under a
  prefix `scripts/deploy.sh` never reads (it walks `dotfiles/<pkg>/`). The live
  package is deployed and symlinked, so the copy asserted nothing; it only
  misled. Moved to `.AGENTTRASH/20261020-tracked-debt/`.
- `.pre-pull-backup/**` — 2 managed-skill files, a local backup in history,
  which `.gitignore` itself declares must stay on disk only. Same destination.
- `dotfiles/noctalia/.local/share/noctalia/wallpapers/` — 23 images, 80.4 MiB.
  Untracked, files left in place: `~/.local/share/noctalia/wallpapers` symlinks
  into this directory and the theme reads it, so deleting them would have gone
  black. Every filename carries its wallhaven ID, so a fresh box restores the
  set with one `curl` per file plus `deploy.sh`; losing the set is an acceptable
  outcome, 80 MiB per clone forever is not.

New page `omp-docs/tools/dotfiles-deploy.md` owns the deploy contract (the
`--check`/sync/`--adopt` modes, `zz-$(hostname)` override semantics, the dconf
and systemd-user special cases) because nothing documented it, plus two laws:
media the pipeline consumes is content not config, and `systemctl --user
enable` snapshots an absolute path — so enabling from a worktree means the
seven-day reap silently kills the unit while `is-enabled` keeps answering
`enabled`. That second law is not theoretical:
`default.target.wants/blankpad-desk-autoswitch.service` pointed into the reaped
`wt/de-redesign-20261009` and desk auto-switching had been off since. It is
relinked to `dotfiles/zz-blankpad/` and left inactive rather than started mid-
session; starting it applies a desk profile.

Refs #40

omp-docs/log.md

@@ -16,6 +16,32 @@ lesson, a few lines. Full incident narratives are recoverable from git
 (`git log --follow omp-docs/log.md`); knowledge that outlives an entry lives
 on its concept page, linked here. Never re-expand an entry in place.
 
+## 2026-10-20 — the secret gate was reading the wrong files, and one credential had already escaped
+
+Found while deciding what else belongs in `dotfiles/`. (1) The gate whitelisted
+extensions (`*.md *.yml *.json *.toml *.sh *.ts *.js`), so a `.env`, `.container`,
+`.ini` or extension-less dotfile was never read — exactly the shapes the dotfiles
+tier is made of. It now scans the whole staged diff for token shapes and, in
+non-prose files, for credential assignments, and it fails closed when `git diff`
+itself errors. That last clause earned its place: the rewrite's first attempt
+passed `-I` to `git diff`, which is not valid there, got an empty file list, and
+reported success on every commit — that is what a blind gate looks like, and it
+looks identical to a clean tree. (2) A live credential had already escaped into
+tracked content: a Caddy basicauth bcrypt hash, its plaintext password, and the
+Pi-hole internal password, in an auto-learned memory file. Redacted — but both
+credentials need **rotation**, because redaction does not un-leak history that
+every machine has already pulled. (3) `home/dank/.omp/dotfiles/**` and
+`.pre-pull-backup/**` were tracked fiction invisible to `deploy.sh`, and 23
+wallpaper JPEGs (80 MiB) rode along in every clone. Laws: a gate must fail closed,
+since a silently-passing gate is worse than none — it buys the belief of safety;
+auto-learned memory is written by a process that has read your terminal, so it is
+a leak surface and gets gated like any config; `systemctl --user enable`
+snapshots an absolute path, so enabling from a worktree means the seven-day reap
+silently kills the unit while `is-enabled` goes on saying `enabled`
+(`blankpad-desk-autoswitch.service` was dangling that way). Details:
+[dotfiles-deploy](tools/dotfiles-deploy.md),
+[home-config-census](inventory/home-config-census.md).
+
 ## 2026-10-20 — engineering skills configured against this KB
 
 `setup-matt-pocock-skills` ran, and its output moved out of the skill's default