The release job sources FORGEJO_TOKEN from a .env beside the flake, and
nothing was holding that file out of a commit. target/ and .devbox/ were
only excluded by .git/info/exclude, which is local to one clone and never
travels, so a fresh checkout had no protection for either.
Also covers what the daemon and the test rigs write into a checkout:
master.key, mail.db, state.json and an operator's own smolboid.toml. No
tracked file becomes ignored.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
