Add .gitignore for local secrets and host dumps

Ignore *.conf and .env (keeping the committed *.conf.example and
.env.example templates) so runtime credentials stay out of the repo.

Also ignore bridge-vlan-show.txt, tmp/, and downloaded disk images, which
are host-specific dumps and build artifacts rather than source.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,15 @@
+# Local secrets — never commit.
+# Scripts read these at runtime; the committed *.conf.example files are the templates.
+*.conf
+!*.conf.example
+.env
+!.env.example
+
+# Host dumps and scratch output
+bridge-vlan-show.txt
+tmp/
+*.qcow2
+*.img
+*.iso
+*.ova
+*.vmdk