Directory skeleton from PLAN.md, plus a .gitignore that blocks .env files, kubeconfigs, terraform state and sealed-secrets key backups. Empty directories are held by .gitkeep so the layout survives a clone.
