fix: pre-landing review fixes (heal ordering, key untrack, content-aware gitignore)

Red-team + specialist findings from /ship pre-landing review:

- CRITICAL: ensure_store_protections ran BEFORE `git pull --ff-only` in
  commit_and_push_secrets; a pull bringing history without .gitignore
  left the post-pull window unprotected and `git add -A` committed AND
  pushed key.txt (reproduced end-to-end). Heal now runs after the pull,
  immediately before staging.
- CRITICAL: .gitignore can't untrack an already-tracked key.txt. Heal
  now defensively `git rm --cached`s a tracked key with a history-scrub
  warning.
- Content-aware heal: a present .gitignore missing the key.txt line is
  rewritten, not skipped (security specialist).
- Init guard now renders the real sanitized clone URL from
  .secrets-store when available, mirroring EGB-282's check_initialized.
- Tests: positive heal-message assertions, non-empty key guard in the
  init test, 4 new regression tests (126 total).

CLAUDE.md

@@ -37,7 +37,7 @@ Single bash script (`secrets`) with subcommands: init, push, pull, list, rm, rek
 secrets              # CLI script (~600 lines bash)
 hooks/pre-commit     # Pre-commit hook template
 test/
-  secrets.bats       # bats-core test suite (118 tests)
+  secrets.bats       # bats-core test suite (126 tests)
   test_helper.bash   # Shared setup/teardown
 README.md            # User-facing documentation
 CLAUDE.md            # This file