Config in, state out: databases, WAL/SHM sidecars, caches, logs, sessions,
run dirs, ssh-control sockets stay OUT of history. Quarantine list: auth.json,
.env, trust.json, private keys never tracked. Pre-commit hook scans staged diff
for live-secret shapes (sk-, ghp_, github_pat_, glpat-, xox, AKIA, PEM headers,
JWTs) before anything reaches the Gitea remote.
Frank