__pycache__/
*.pyc
.DS_Store
Thumbs.db
*.tmp
.pytest_cache/
.ruff_cache/
# Secrets / keys -- never commit:
.env
*.pem
*.key
id_rsa
# Private pre-publish OPSEC keyword-scan config (enumerates private names/codes; kept local only):
.gitleaks-opsec.toml
# L2 config + content never live here (this is L1a portable-core only):
config/
*.local.*
bootstrap/repos.txt
