Add inbox-check line; align .gitignore with canonical .claude policy

Cross-repo git-hygiene audit remediation: surface ~/Projects/standards/INBOX.md items at session start, and switch .gitignore to the deny-by-default .claude/* block (shared wiring allow-listed) plus the canonical secrets/env lines — per standards/portability.md.

.gitignore

@@ -13,6 +13,16 @@ __pycache__/
 !.env.beta.example
 data/secrets/
 
+# ── Claude Code (deny by default, allow-list shared wiring — see standards/portability.md) ──
+.claude/*
+!.claude/rules/
+!.claude/agents/
+!.claude/commands/
+!.claude/skills/
+!.claude/settings.json
+# launch.json is a deliberate, secret-free debug config CRM commits
+!.claude/launch.json
+
 # ── Local databases & SQLite sidecars ──
 # CRM is canonical and lives on the Start9 /data volume; never commit live LP
 # data into git (guardrail #1). Dev/synthetic DBs are local-only.