Extract ensure_gitignore from init_repo so it can be reused by clone_repo (GitHub "Create New" flow) and repair_vault. New vaults created via any path now get .DS_Store excluded by default. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>