Pull #433 committed forge.db (an empty schema) and ssh/host_ed25519 / .pub at the repository root. They were left by a forge started with its data directory set to the checkout. No live forge uses that key: production and lab use their own data directories. But a private key in the tree is a bad example, and every clone and preview carries it.
Acceptance criteria
[ ] forge.db*, ssh/ and *.sock at the root are deleted from main and listed in .gitignore.
[ ] The forge refuses to boot when its data directory is the repository checkout itself, or a path inside it that git does not ignore. It says why in one line.
[ ] The gate fails when a tracked file looks like a private key (-----BEGIN … PRIVATE KEY-----) or a SQLite database, outside an explicit allow-list for test fixtures.
[ ] Tests cover the boot refusal and the gate rule.
Pull #433 committed
forge.db(an empty schema) andssh/host_ed25519/.pubat the repository root. They were left by a forge started with its data directory set to the checkout. No live forge uses that key: production andlabuse their own data directories. But a private key in the tree is a bad example, and every clone and preview carries it.Acceptance criteria
forge.db*,ssh/and*.sockat the root are deleted frommainand listed in.gitignore.-----BEGIN … PRIVATE KEY-----) or a SQLite database, outside an explicit allow-list for test fixtures.