# build output
/out/

# secrets payload — only README.md and run.sh are tracked
/04-secrets/*
!/04-secrets/README.md
!/04-secrets/run.sh