chore: scaffold repository layout

Directory skeleton from the project plan, held open with .gitkeep so the layout
survives a clone. The .gitignore blocks credentials, kubeconfigs, terraform
state and local editor state, and keeps *-sealed.yaml committable since those
are encrypted on purpose.

.gitignore

@@ -0,0 +1,108 @@
+# ---------------------------------------------------------------------------
+# Owner documents. Held back deliberately for now, not permanently.
+# Note that agents cloning this repo will not receive AGENTS.md while it is
+# listed here, so they have to be handed the rules another way.
+# ---------------------------------------------------------------------------
+AGENTS.md
+PLAN.md
+
+# ---------------------------------------------------------------------------
+# Secrets and credentials. Nothing in this block ever reaches the repository.
+# ---------------------------------------------------------------------------
+.env
+.env.*
+!.env.example
+*.env
+
+# private keys and certificates
+*.pem
+*.key
+*.p12
+*.pfx
+*.jks
+id_rsa*
+id_ecdsa*
+id_ed25519*
+!*.pub
+
+# cluster and cloud credentials
+*.kubeconfig
+kubeconfig
+.kube/
+.netrc
+.npmrc
+credentials
+credentials.json
+service-account*.json
+
+# sealed-secrets private key backups. Losing this file means losing every
+# sealed secret, so it is backed up outside the repo and never inside it.
+*sealed-secrets-key*.yaml
+
+# Plaintext inputs to Sealed Secrets. The sealed output (*-sealed.yaml) is
+# encrypted and IS meant to be committed, so it is not ignored here.
+deploy/secrets/*.plain.yaml
+deploy/secrets/*.unsealed.yaml
+
+# ---------------------------------------------------------------------------
+# AI assistants, IDEs, editors. Local tooling, not part of the project.
+# ---------------------------------------------------------------------------
+.claude/
+.codex/
+.cursor/
+.aider*
+.continue/
+.windsurf/
+.github-copilot/
+CLAUDE.local.md
+
+.vscode/
+.idea/
+*.iml
+.fleet/
+.zed/
+.helix/
+.nvim.lua
+.nvimrc
+*.sublime-project
+*.sublime-workspace
+.vim/
+*.swp
+*.swo
+*~
+.\#*
+\#*\#
+
+.direnv/
+.envrc
+
+# ---------------------------------------------------------------------------
+# Terraform. The lock file is committed on purpose; state never is.
+# ---------------------------------------------------------------------------
+.terraform/
+*.tfstate
+*.tfstate.*
+*.tfvars
+!*.tfvars.example
+crash.log
+crash.*.log
+override.tf
+override.tf.json
+
+# ---------------------------------------------------------------------------
+# Build output and local scratch
+# ---------------------------------------------------------------------------
+bin/
+dist/
+node_modules/
+*.test
+*.out
+coverage.*
+vendor/
+
+# ---------------------------------------------------------------------------
+# OS noise
+# ---------------------------------------------------------------------------
+.DS_Store
+Thumbs.db
+desktop.ini