chore: birth — state-out ignore policy + secret-gate pre-commit hook

Config in, state out: databases, WAL/SHM sidecars, caches, logs, sessions,
run dirs, ssh-control sockets stay OUT of history. Quarantine list: auth.json,
.env, trust.json, private keys never tracked. Pre-commit hook scans staged diff
for live-secret shapes (sk-, ghp_, github_pat_, glpat-, xox, AKIA, PEM headers,
JWTs) before anything reaches the Gitea remote.

.githooks/pre-commit

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Secret gate: block any commit whose staged diff contains live-secret shapes.
+# This repo is pushed to a Gitea remote; anything committed is instantly visible
+# on the fleet. Deliberate override: ALLOW_SECRETS=1 git commit ...
+set -uo pipefail
+
+staged=$(git diff --cached --diff-filter=ACM -U0 -- '*.md' '*.yml' '*.yaml' '*.json' '*.toml' '*.sh' '*.ts' '*.js')
+[ -z "$staged" ] && exit 0
+
+patterns='sk-[A-Za-z0-9]{18,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[A-Z0-9]{16}|ASIA[A-Z0-9]{16}|BEGIN [A-Z ]*PRIVATE KEY|aes_[A-Za-z0-9/+]{40}|eyJ[A-Za-z0-9_-]{20,}\.ey'
+
+hits=$(printf '%s\n' "$staged" | grep -Ei "$patterns" || true)
+if [ -n "${ALLOW_SECRETS:-}" ]; then
+  [ -n "$hits" ] && printf 'secret-gate: ALLOW_SECRETS set, allowing %s secret-shaped string(s) through.\n' "$(printf '%s\n' "$hits" | wc -l)"
+  exit 0
+fi
+
+if [ -n "$hits" ]; then
+  {
+    echo "SECRET GATE: staged diff contains $(printf '%s\n' "$hits" | wc -l) secret-shaped string(s):"
+    printf '%s\n' "$hits" | sed 's/^/  /'
+    echo "Fix it, or override deliberately: ALLOW_SECRETS=1 git commit ..."
+  } >&2
+  exit 1
+fi
+exit 0

.gitignore

@@ -0,0 +1,45 @@
+# ============================================================================
+# Command-center repo: config in, state out.
+# Everything ignored here is runtime state a running agent mutates constantly.
+# Git history must mean "the configuration changed", not "the agent breathed".
+# ============================================================================
+
+# --- databases + sqlite sidecars (hot, binary, unbounded growth) -----------
+*.db
+*.db-shm
+*.db-wal
+*.sqlite
+*.sqlite3
+
+# --- runtime state dirs -----------------------------------------------------
+cache/
+agent/cache/
+logs/
+run/
+sessions/
+terminal-sessions/
+ssh-control/
+remote-host/
+
+# --- quarantined secrets: never tracked, ever ------------------------------
+auth.json
+**/auth.json
+.env
+**/.env
+trust.json
+**/trust.json
+*.pem
+*.key
+identity*
+
+# --- dependency installs (regenerable from manifests) ----------------------
+node_modules/
+bun.lock
+package-lock.json
+
+# --- misc ephemera ----------------------------------------------------------
+gpu_cache.json
+last-changelog-version
+.DS_Store
+*.swp
+*.tmp