Red-team + specialist findings from /ship pre-landing review:
- CRITICAL: ensure_store_protections ran BEFORE `git pull --ff-only` in
commit_and_push_secrets; a pull bringing history without .gitignore
left the post-pull window unprotected and `git add -A` committed AND
pushed key.txt (reproduced end-to-end). Heal now runs after the pull,
immediately before staging.
- CRITICAL: .gitignore can't untrack an already-tracked key.txt. Heal
now defensively `git rm --cached`s a tracked key with a history-scrub
warning.
- Content-aware heal: a present .gitignore missing the key.txt line is
rewritten, not skipped (security specialist).
- Init guard now renders the real sanitized clone URL from
.secrets-store when available, mirroring EGB-282's check_initialized.
- Tests: positive heal-message assertions, non-empty key guard in the
init test, 4 new regression tests (126 total).
2a7afc34dd