chore: harden public ignore rules and release gate evidence

.gitignore

@@ -1,5 +1,40 @@
+# SwiftPM / Xcode
 .build/
 .swiftpm/
-dist/
 DerivedData/
+*.xcuserstate
+xcuserdata/
+*.xcresult
+
+# Local packaging output
+dist/
+
+# Python / tooling caches (scripts and checkers)
+__pycache__/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage/
+htmlcov/
+
+# Local environment and credentials
+.env
+.env.*
+!.env.example
+*.pem
+*.p12
+*.mobileprovision
+*.cer
+*.certSigningRequest
+AuthKey_*.p8
+
+# Editor / OS / assistant local state
 .DS_Store
+.idea/
+.vscode/
+.cursor/
+.codex/
+.agents/
+*.swp
+*~

docs/release/0.1.0/BLOCKERS.md

@@ -6,10 +6,11 @@ The canonical public source is published through a fresh-history
 `rsitech-ai/devscope` snapshot. Legacy private objects, internal audits,
 monetization work, and author metadata are not transferred.
 
-1. **Repository protections — Repository owner.** Keep pull-request protection,
-   private vulnerability reporting, dependency alerts, and available security
-   features enabled. Add required hosted checks when Actions billing permits
-   reliable execution.
+1. **Repository protections — Maintained.** Public visibility, pull-request
+   protection, required `Secret Scan` and `Release Gates` checks, private
+   vulnerability reporting, secret scanning, push protection, and Dependabot
+   security updates are enabled on `rsitech-ai/devscope`. Re-verify after any
+   organization policy change.
 2. **Public archive — Release owner.** Inspect the exact public commit archive and
    record the tag, source commit, checksum, and all limitations in release
    metadata.

docs/release/0.1.0/RELEASE_MANIFEST.json

@@ -34,7 +34,11 @@
     "repositoryVisibilityChanged": true,
     "ownerSettingsVerified": true,
     "exactArchiveValidationPassed": true,
-    "hostedChecksStatus": "record-from-public-organization-pr"
+    "hostedChecksStatus": "required-secret-scan-and-release-gates-on-main",
+    "secretScanningEnabled": true,
+    "secretScanningPushProtectionEnabled": true,
+    "dependabotSecurityUpdatesEnabled": true,
+    "privateVulnerabilityReportingEnabled": true
   },
   "artifacts": [
     {

docs/release/0.1.0/RELEASE_STATUS.md

@@ -35,8 +35,8 @@ packaging passes, but the sandbox product is not feature-equivalent.
 | Community prerelease | READY (unnotarized) | Explicit acknowledgement, ad-hoc signature disclosure, embedded trust warning, clean universal zip, and published SHA-256 required |
 | Developer ID identity | PASS (installed) | `Developer ID Application: Rafal Sikora (2NY8A789TN)` is available with its private key |
 | Notarization | BLOCKED:EXTERNAL | No `devscope-notary` Keychain profile or equivalent App Store Connect credentials are configured |
-| Repository publication settings | OWNER ACTION | Verify public visibility, default-branch protection, private vulnerability reporting, and security settings after organization import |
-| Remote required checks | VERIFY ON PUBLIC PR | Record organization-run results; do not inherit the legacy personal repository's billing failure as code evidence |
+| Repository publication settings | PASS | Public `rsitech-ai/devscope`; branch protection with required PR, conversation resolution, and admin enforcement; private vulnerability reporting enabled; secret scanning, push protection, and Dependabot security updates enabled |
+| Remote required checks | PASS | `Secret Scan` and `Release Gates` are required status checks on `main`; organization PR and main-branch workflow runs recorded green |
 | Exact hardened-source archive | PASS (local) | The source tree passed readiness, 671 strict tests, warnings-as-errors release build, and exact-tree Gitleaks from a clean `git archive`; repeat from the exact public commit |
 
 ## Log boundary