docs+chore: private-copy workflow guide; stop ignoring run manifests

[21tmccauley]

Two related changes: a customer-facing guide for keeping a private copy of this repo, and the manifest-tracking fix that guide turned up.

1. docs/private_mirror_workflow.md

A guide for teams whose fetcher work can't be public — written to be handed to their engineers directly. First reader is the Epicor CR-26 engagement.

A GitHub fork can't be a private working copy: forks inherit the upstream's visibility and GitHub disables the visibility control on them, and every commit in a fork network stays reachable by SHA from the public upstream forever — deleting the branch, the fork, or force-pushing does not revoke access. That matters here because fetcher code carries tenant and subscription IDs, resource group and endpoint names, and each control's population scope; with narratives alongside it, the boundary's exceptions and limitations too.

So the guide documents a private mirror instead: mirror this repo into a private repo, add ours as a plain read-only remote (public needs no access grant), and merge release tags. A fork becomes optional and, in the recommended path, unnecessary — their Paramify contact already has collaborator access to the private repo and can carry any general-purpose change upstream.

Points verified empirically against a scratch upstream/mirror pair rather than written from memory:

• Upstream tags namespaced into refs/tags/paramify/* on fetch. Tags are one flat namespace. Once a customer cuts their own v0.4.0-beta and we publish v0.4.0-beta, a plain git fetch upstream --tags prints ! [rejected] (would clobber existing tag) and exits 0 — the rejection scrolls past, the command looks successful, and git merge v0.4.0-beta takes their commit while everyone believes they took ours.
• Mirror verification is a git ls-remote ref diff plus a default-branch check. Tags being present only proves tags copied. Separately, if the destination repo's HEAD is unset, cloning yields a working copy with no branch checked out and the first commit silently starts an orphan history — the same refusing to merge unrelated histories breakage the mirror exists to prevent. The ref diff does not catch that, which is why both checks are there.
• Leads with GitHub's importer, not git push --mirror. --mirror force-writes every ref at the destination and deletes destination refs absent locally, so in a repo with both remotes configured one transposed invocation both leaks private branches and destroys upstream history. The CLI path stays as a fallback, sequenced through a throwaway bare clone deleted before a second remote exists, with git remote set-url --push upstream no_push as a further guard.
• Single main in the customer repo. A local pristine main advanced with --ff-only plus a second working branch was considered and rejected: redundant with upstream/main, which is already an unwritable tracking ref, and it adds a permanent failure mode where one stray commit breaks --ff-only forever with reset --hard as the only recovery.
• Append-only upstream history, stated as a commitment to the reader — a rewrite on our side leaves every mirror on commits that no longer exist, with no clean recovery.
• A "Questions your security review will ask" table, since the privacy argument is the reason the workflow exists and needs to travel to people who won't read the git mechanics.

2. Run manifests are no longer gitignored

Writing that guide surfaced a real defect. .gitignore listed /manifest.yaml and /manifests/ while a manifest.yaml was also tracked (it entered the index at c2f1c49). Ignore rules don't apply to already-tracked files, so the entry was inert: edits to the shipped manifest staged by default, and anyone working from a copy of this repo hit a conflict at that path on every upgrade.

The ignore was the wrong instinct regardless. A manifest records which evidence you collect, so under a compliance program it belongs in version control — and it holds no secret values, because ${env:VAR} resolves from the environment at run time, so a manifest names its secrets without containing them.

• Renames the tracked manifest.yaml to example_manifest.yaml — content unchanged (13 Datadog entries; paramify validate reports valid). It now reads as the reference sample it always was instead of shadowing the path the builder writes to.
• Drops both lines from .gitignore, with a comment explaining why nothing there is ignored.
• Nothing ships at ./manifest.yaml anymore, so a manifest you create there cannot collide with ours on merge.

No code change. paramify manifest init's ./manifest.yaml default and the manifests/*.yaml picker convention are untouched. list_manifests already guarded on existence and read_manifest returns an empty manifest for an absent path, so a fresh clone with no manifest degrades to "no fetchers" rather than an error. 233 tests pass; nothing referenced the tracked file.

Upgrade note is in CHANGELOG.md under Unreleased: anyone relying on the tracked manifest.yaml copies example_manifest.yaml over it or passes --manifest explicitly.