directive update must maintain Deft .gitignore coverage and doctor must flag missing entries

[polfer]

Summary

directive update can create or refresh the per-project .deft/core payload without adding the expected Deft .gitignore entries. On a brownfield project, this leaves the entire framework deposit and local Deft state visible to git add, creating a large accidental-commit exposure during first adoption.

Evidence

In a brownfield app after npm i -g @deftai/directive followed by directive update:

• .deft/core/** was created/refreshed and appeared as untracked Git content.
• xbrief/.eval/doctor-state.json and .deft/xbrief-migrate-backup-* also appeared as untracked content.
• .gitignore contained no Deft entries.
• directive doctor did not warn that required Deft ignore coverage was missing.

The current init path has .gitignore upkeep, but the update/upgrade path appears to bypass it. For a first-time brownfield user who discovers and runs directive update, the result is a repo ready to accidentally commit framework payload and local operational state.

Proposed behavior

Treat Deft .gitignore coverage as a shared adoption invariant, not just an init side effect.

• directive update / upgrade refresh paths should ensure the canonical Deft ignore entries when they create or refresh .deft/core, unless the project is intentionally in a tracked-deposit mode.
• directive doctor should check Deft .gitignore coverage and emit a clear repair action when expected entries are missing.
• The repair should be idempotent and avoid blanket ignores that hide intentional project artifacts.

Expected entries should cover at least the framework deposit, local runtime state, migration backups, and generated eval state, for example .deft/core/, .deft-cache/, selected .deft/*.json local state, .deft/*backup*/ patterns, and current xbrief/.eval/* generated files.

Acceptance criteria

• A brownfield project that runs directive update as its first Deft command does not leave .deft/core/** exposed as untracked committable content.
• directive update either repairs missing Deft .gitignore entries or refuses with a clear command to run the repair/init path.
• directive doctor reports missing Deft .gitignore coverage with one actionable fix.
• The canonical ignore baseline is updated for xBRIEF-era paths, not only legacy vbrief/.eval/* paths.
• Tests cover first-run brownfield update, idempotent re-run, tracked-deposit opt-out/compatibility, and doctor detection.

Related

Related but not duplicate: #2123 covers already-tracked migrated deposits and the vendored-to-hybrid uncommit decision. This issue covers missing ignore maintenance when update creates or refreshes an untracked deposit during adoption.

Related adoption UX: #2198, #2199, #2200.