untrack the build result symlink and harden .gitignore

result is a symlink into /nix/store that nix build rewrites on every
invocation, so tracking it churns the history and pins a store path that
means nothing on any other machine. it was committed pointing at a t480
system while sitting on shadow.

the two git-secret lines are what `git secret init` writes. worth being
explicit about what they do and do not cover: `!*.secret` un-ignores the
*encrypted* blobs only. nothing here protects the plaintext originals -
that relies entirely on `git secret add` appending each plaintext path to
this file, so always run it from the repo root rather than hand-editing
.gitsecret/paths/mapping.cfg.

.gitsecret/keys is git-secret's gpg homedir. pubring.kbx is meant to be
committed, but a stray `gpg --homedir .gitsecret/keys --import` of a
private key would drop private-keys-v1.d/ in there, so those paths are
ignored up front rather than after the fact.

.gitignore

@@ -1 +1,24 @@
 .session
+
+# `nix build` / `nixos-rebuild build` output symlink. Points into /nix/store and
+# churns on every build, so it must not be tracked.
+result
+result-*
+
+# git-secret. `git secret init` writes the random_seed and the `!*.secret`
+# negation; the rest is hardening.
+#
+# WARNING: `!*.secret` only un-ignores the *encrypted* blobs. It does nothing to
+# protect the plaintext originals -- that relies entirely on `git secret add`
+# appending each plaintext path below. Always run `git secret add <file>` from
+# the repo root (never hand-edit .gitsecret/paths/mapping.cfg) and verify with
+# `git status` before committing.
+.gitsecret/keys/random_seed
+# .gitsecret/keys is git-secret's GPG homedir. pubring.kbx is meant to be
+# committed; private key material and sockets never are.
+.gitsecret/keys/private-keys-v1.d/
+.gitsecret/keys/openpgp-revocs.d/
+.gitsecret/keys/*.gpg~
+.gitsecret/keys/.#*
+.gitsecret/keys/S.*
+!*.secret