Adds doc/rotation.md: what is already in place for optional rotation
(RotationHint, Status::Rotated, fingerprint-as-unit-of-work), what it would
take, and the four constraints a future executor does not get to relax —
chiefly that nanny holding provisioning credentials is the real cost of the
feature and must be opt-in per service.
Broadens the noise exclusions after a first sweep of a real ~/git produced
1030 working-tree findings, 273 of them from one crate's vendored
target/container/cargo/registry. Excluding all of target/ rather than just
debug/ and release/, plus vendored dependencies, build output, tool caches
and minified assets. .git/config stays readable: a password in a remote URL
is a genuine spill.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XAqHWfdMAsYu1o36tgeima
rob thijssen
991ab992da
