Harden headless Git authentication and signing - #39

Summary

• Restore the machine-local Git include used to route personal and work GitHub credentials without committing either credential store.
• Harden SSH commit signing for headless sessions and document the Mini, Tailscale SSH, restart, and GitHub authentication setup.
• Add public-repository secret ignores, agent credential-handling rules, and a pinned gitleaks pre-commit hook.
• Supersede the signing fix in Fix SSH commit signing: quoting in gpg.ssh.defaultKeyCommand #26 and extract the relevant public-safe repository hygiene from Repo hygiene: secret gitignore patterns + gitleaks pre-commit #19 without importing its stacked commits.

Test Plan

• pre-commit run --all-files — passed, including gitleaks.
• tests/assimilate-path.sh — passed.
• tests/claude-sync-settings.sh — passed.
• tests/codex-sync-config.sh — passed.
• git diff --check origin/main...HEAD — passed.
• Verified all machine-local config, credential-store, token, key, and agent-override examples are ignored and no sensitive filename is tracked.
• Created a throwaway signed commit with the Mini's normal Git configuration and verified this commit contains an SSH signature.
• brew list --versions pre-commit — passed (pre-commit 4.6.2). The full existing Brewfile check still reports unrelated packages absent on the Mini: font-hack-nerd-font, gh, mosh, tmux, and yq.