Ignore config/ as a directory and correct two stale hints

[Amplify-Logic]

Batch B1 of the toolchain update programme: one security fix ported from upstream, plus two verified fork-local corrections.

Ported upstream commits

• e595611 - fix(gitignore): ignore config/ as a directory, not by exact filename (fix: ignore the entire config directory kunchenguid/firstmate#1261)
• a53ffc1 - fix(tests): replace source-content .gitignore assertion with behavioral coverage (test: replace gitignore source assertion with behavioral coverage kunchenguid/firstmate#1304)

The .gitignore conflict was resolved to upstream's end state: every individual config/... entry, including this fork's config/primary-handoff, is replaced by a single config/ rule. The per-file list was the defect - on a public repo it leaves every future captain-private config knob committable. Nothing under config/ is tracked today, and this keeps it that way permanently. Nothing else in .gitignore changed.

Fork-local corrections

1. docs/configuration.md claimed Kimi Code 0.27.0 was verified only as a primary and that fm-spawn "deliberately rejects Kimi workers". bin/fm-spawn.sh accepts --harness kimi (adapter allowlists at lines 339 and 653, worker launch template at 420, worker model pin at 628), and AGENTS.md section 4 plus docs/kimi-harness.md carry the 2026-07-23 worker evidence. The sentence now matches the code.
2. bin/fm-spawn.sh:443 printed the Pi install hint for @mariozechner/pi-coding-agent. The installed and tested lineage is @earendil-works/pi-coding-agent. It was the only wrong-lineage reference in the tree.

Acceptance evidence

1. git check-ignore -v - all four ignored, attributed to the single config/ rule:

.gitignore:11:config/	config/calm
.gitignore:11:config/	config/herdr-presentation-spaces
.gitignore:11:config/	config/some-future-knob
.gitignore:11:config/	config/primary-handoff

2. git ls-files config/ - empty (nothing private is tracked):

(no output, exit 0)

3. bash tests/fm-gitignore-config.test.sh:

ok - config/ is ignored as a directory, covering unlisted and nested paths
ok - an unrelated path outside config/ remains visible to git
(exit 0)

4. git ls-files -s tests/fm-gitignore-config.test.sh - executable bit preserved by the cherry-pick:

100755 5b864dd6466a14f79e10e804b531178ae8b030e5 0	tests/fm-gitignore-config.test.sh

5. bin/fm-lint.sh - clean:

fm-lint.sh: ShellCheck 0.11.0 (pinned 0.11.0)
exit=0

6. bin/fm-leak-guard.sh - clean:

fm-leak-guard.sh: PASS - no email, /Users/<name>, or live-token shapes in scanned tracked files
exit=0

7. rg -n 'mariozechner' - no matches (exit 1).

8. rg -n 'deliberately rejects Kimi workers' docs/ - no matches (exit 1).

9. bin/fm-test-run.sh --changed --base 054aa7f - green:

FM_TEST_SUMMARY total=35 failed=0 skipped_gate=1 duration_ms=271939
FM_TEST_SUMMARY_FAMILY family=backend-dispatch count=7 duration_ms=102057 failed=0
FM_TEST_SUMMARY_FAMILY family=pure-contract-unit count=27 duration_ms=168288 failed=0
FM_TEST_SUMMARY_FAMILY family=unclassified count=1 duration_ms=90 failed=0
exit=0

Scoped to the change set rather than --all: 35 scripts covering the backend/dispatch and spawn families plus the new gitignore test. The one gate skip is the standing Herdr-pin gate, owned by its dedicated CI lane.

Note

no-mistakes-required.yml is expected to fail here - it is advisory on this fork. The gate that matters is ci.yml.