Three fixes, found from a real Ubuntu second-machine setup failure:
1. cmd_init: if key.txt exists but the store has no .git, die BEFORE
git init with directed guidance to clone the existing secrets repo
instead. Previously init ran git init, then age-keygen died on the
existing key, leaving a half-initialized store (.git but no
.gitignore or hook).
2. ensure_store_protections: push/pull/rekey now restore a missing
store .gitignore (and pre-commit hook) before any `git add -A`.
Without the .gitignore, add -A would commit key.txt to the remote.
3. cmd_rekey: the re-encrypt loop used a bare "$dir"* glob, which never
matches dotfiles — .env blobs were decrypted to the tmpdir but never
re-encrypted, leaving them on the OLD key (undecryptable) while the
new key overwrote key.txt. Glob now matches the decrypt loop
("$dir"* "$dir".*). Exposed by the self-heal test: with nothing
staged, the empty commit failed mid-rekey.
Tests: 5 new bats tests (118 total) — init guard, .gitignore self-heal
on push/pull/rekey, and a rekey round-trip that survives key rotation.
25cd1feb43