Directory skeleton from the project plan, held open with .gitkeep so the layout
survives a clone. The .gitignore blocks credentials, kubeconfigs, terraform
state and local editor state, and keeps *-sealed.yaml committable since those
are encrypted on purpose.
