chore: birth — state-out ignore policy + secret-gate pre-commit hook

Config in, state out: databases, WAL/SHM sidecars, caches, logs, sessions,
run dirs, ssh-control sockets stay OUT of history. Quarantine list: auth.json,
.env, trust.json, private keys never tracked. Pre-commit hook scans staged diff
for live-secret shapes (sk-, ghp_, github_pat_, glpat-, xox, AKIA, PEM headers,
JWTs) before anything reaches the Gitea remote.

.gitignore

@@ -0,0 +1,45 @@
+# ============================================================================
+# Command-center repo: config in, state out.
+# Everything ignored here is runtime state a running agent mutates constantly.
+# Git history must mean "the configuration changed", not "the agent breathed".
+# ============================================================================
+
+# --- databases + sqlite sidecars (hot, binary, unbounded growth) -----------
+*.db
+*.db-shm
+*.db-wal
+*.sqlite
+*.sqlite3
+
+# --- runtime state dirs -----------------------------------------------------
+cache/
+agent/cache/
+logs/
+run/
+sessions/
+terminal-sessions/
+ssh-control/
+remote-host/
+
+# --- quarantined secrets: never tracked, ever ------------------------------
+auth.json
+**/auth.json
+.env
+**/.env
+trust.json
+**/trust.json
+*.pem
+*.key
+identity*
+
+# --- dependency installs (regenerable from manifests) ----------------------
+node_modules/
+bun.lock
+package-lock.json
+
+# --- misc ephemera ----------------------------------------------------------
+gpu_cache.json
+last-changelog-version
+.DS_Store
+*.swp
+*.tmp