Replace real secrets in tmp_remote/configuration.yml with __ROTATE_*__ placeholders. All leaked values have already been rotated. Also add .claude/, .codex/, and security_artifacts/ to .gitignore.