Ignore local dev scratch and delivery build output

Several days of endpoint-agent work left DB dumps, sample datasets, captured command output, generated maps, vuln scan output, merge-kit exports, and staged agent publish trees in the tree. None are product source. Ignore them so status shows only real work and they cannot be committed by accident. exports/ stays on disk for reference. agent/.gitignore also reserves dev-bin/ and _stage/ for delivery-build scratch.

.gitignore

@@ -73,6 +73,10 @@ id_rsa.*
 *.ppk
 *.p12
 *.pfx
+
+# Local/test TLS material for the dev HTTPS listener. Self-signed, per-host,
+# never shipped. The container mounts these at runtime; a site provides its own.
+certs/
 secrets.json
 secrets.yaml
 secrets.yml
@@ -92,3 +96,46 @@ devnotes/
 # defeats the intentional skip in the docs publish/version tests. Keep this
 # local-only guide out of version control so those tests skip as designed.
 docs/CSV-IMPORT-GUIDE.md
+
+# Local-only authored docs (executive summaries, workflow/security writeups,
+# planner exports, draft decks and diagrams). Same reasoning as above: keep
+# personal docs out of version control. docs/openapi.json stays tracked and
+# is intentionally NOT ignored here.
+docs/EXECUTIVE-SUMMARY.md
+docs/DESIGN-DECISIONS-agent.md
+docs/OPERATOR-WORKFLOW.md
+docs/SECURITY-RISK-ASSESSMENT.md
+docs/ShopDB-Planner-Tasks.csv
+docs/DRAFT--ShopDB-CSV-Import-Guide.pptx
+docs/diagrams/
+docs/media/
+
+# Local-only working artifacts: DB dumps, sample/test datasets, scratch
+# scripts, captured command output, generated maps/reports, vulnerability
+# scan output, and staged agent publish trees. None of these are product
+# source; they are developer scratch that should never enter version control.
+# exports/ (merge kits, decks, catalog snapshots) stays on disk for reference
+# but is not tracked.
+backups/
+exports/
+testdata/
+vuln/
+agent/publish-wjf/
+*.sql
+shopmap.pdf
+shopmap.png
+agent_build.txt
+agent_publish.txt
+backend_out.txt
+backend_out2.txt
+docker_build.txt
+docker_up.txt
+gates_out.txt
+pytest_targeted.txt
+alandry.py
+kendry.py
+
+# Scratch tooling under scripts/ (catalog diff/merge helpers, docx generator).
+# Not product source; developer-local utilities.
+scripts/.temp/
+scripts/docs/

agent/.gitignore

@@ -3,5 +3,10 @@ bin/
 obj/
 publish/
 
-# Local publish scratch and command-output captures.
+# Application-delivery development builds. Held in reserve for extensive
+# testing; never shipped to a site publish folder or tracked.
+dev-bin/
+
+# Local publish/staging scratch and command-output captures.
+_stage/
 *.user