Add inbox-check line; align .gitignore with canonical .claude policy

Cross-repo git-hygiene audit remediation: surface ~/Projects/standards/INBOX.md items at session start, and switch .gitignore to the deny-by-default .claude/* block (shared wiring allow-listed) plus the canonical secrets/env lines — per standards/portability.md.

.gitignore

@@ -21,6 +21,8 @@ logs/
 
 # Env
 .env
+.env.*
+!.env.example
 .env.local
 .env.*.local
 
@@ -49,3 +51,11 @@ proof-of-work/prisma/data/*.db
 start9/*/seed/data/*.db
 start9/*/seed/data/*.db.bak
 start9/*/seed/data/*.bak
+
+# Claude Code — deny by default, allow-list shared wiring (see standards/portability.md)
+.claude/*
+!.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json

AGENTS.md

@@ -2,6 +2,9 @@
 
 Self-hosted multi-user workout logger (Next.js app) packaged as a StartOS 0.4 `s9pk`, published to a private Start9 registry.
 
+> **Inbox check:** At session start, if `~/Projects/standards/INBOX.md` exists, scan it for
+> items tagged `(Workout-log)` and surface them before proposing next steps; triage with `/triage`.
+
 ## Stack (versions that matter)
 
 - **Next.js 15** (App Router, server components + server actions, SSE streaming) — dynamic request APIs are async (see Conventions)