Add inbox-check line; align .gitignore with canonical .claude policy

Cross-repo git-hygiene audit remediation: surface ~/Projects/standards/INBOX.md items at session start, and switch .gitignore to the deny-by-default .claude/* block (shared wiring allow-listed) plus the canonical secrets/env lines — per standards/portability.md.

.gitignore

@@ -26,8 +26,14 @@ ytdlp-cache/
 
 # Local dev secrets
 .env
+.env.*
+!.env.example
 
-# Claude Code state (worktrees, plans, etc.) — but DO track the portable
-# rules symlinks so scoped guides lazy-load in any clone.
+# Claude Code — deny by default (worktrees, plans, local settings stay out),
+# allow-list shared wiring (see standards/portability.md).
 .claude/*
 !.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json