ci: add pilot v1 hardening guards

private-config/.gitignore

@@ -1,4 +0,0 @@
-*.env
-*.local
-!.gitignore
-!*.example

private-config/.gitkeep

@@ -0,0 +1 @@
+

private-config/README.md

@@ -0,0 +1,13 @@
+# private-config
+
+This directory is reserved for local, host-specific, or secret configuration.
+
+Do not commit real runtime values here. Git only allows:
+
+- `private-config/README.md`
+- `private-config/.gitkeep`
+- `private-config/*.example`
+- `private-config/*.template`
+
+Use `scripts/check_private_config_guard.sh` before commits and in CI to verify
+that no private config file has entered the git index.