Extract ensure_gitignore from init_repo so it can be reused by
clone_repo (GitHub "Create New" flow) and repair_vault. New vaults
created via any path now get .DS_Store excluded by default.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>