Require Git hygiene for all agents in this workspace.

Bind commit/push/PR safety, gitea_vps-only remote ops, and secret
scans in AGENTS.md, with CLAUDE.md and Grok rules so every harness loads them.

.gitignore

@@ -1,11 +1,45 @@
+# Secrets and local env (never commit)
 .env
 .env.*
 !.env.example
+*.pem
+*.key
+id_rsa*
+id_ed25519*
+credentials.json
+token.json
+secrets/
+**/secrets/
+
+# Runtime / local state
 state/
 *.log
+logs/
+
+# Python
 .venv/
+venv/
 __pycache__/
+*.py[cod]
 .pytest_cache/
 .ruff_cache/
 .mypy_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+
+# Node (if introduced later)
+node_modules/
+
+# OS / editor noise
 .DS_Store
+Thumbs.db
+*.swp
+*~
+
+# Agent / IDE local overrides (do not commit personal agent state)
+CLAUDE.local.md
+.claude/settings.local.json
+.grok/local/