chore: ignore secrets, machine-local files and runtime state

The bare repo runs with status.showUntrackedFiles=no, so this is not about
quietening git status - it guards against an absent-minded "config add" over a
home directory full of credentials. It does not stop "config add -f"; nothing
here protects against intent.

mailsecrets.py is listed because that is the existing pattern: the waybar mail
module imports its IMAP credentials from it, and the file has never been
committed. That has held so far by discipline alone.

Private keys are excluded and public ones re-included. Verified with
check-ignore rather than assumed - reading its exit code alone is misleading,
since a matching negative pattern also exits 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,32 @@
+# The repository is checked out over $HOME with a bare repo and
+# status.showUntrackedFiles=no, so this list is not there to quieten
+# "git status" - it is a guard against an absent-minded "config add".
+#
+# It does not stop "config add -f". Nothing here protects against intent, only
+# against carelessness.
+
+# Secrets - never in the repository.
+# mailsecrets.py is the existing pattern: .config/waybar/modules/mail.py
+# imports its IMAP credentials from it and the file has never been committed.
+mailsecrets.py
+.netrc
+.pgpass
+*.key
+*.pem
+id_*
+!id_*.pub
+
+# Machine-local - these must differ per machine, so a shared version would
+# overwrite the very thing that distinguishes them.
+.config/dotconfs/role
+.config/zsh/rc.d/90-local.zsh
+
+# Left behind by the rollout on purpose, as a way back.
+.zshrc.pre-dotconfs
+.config-backup/
+
+# Runtime state and caches.
+.zsh_history
+.zcompdump*
+.cache/
+.p10k-instant-prompt-*.zsh