chore: add security .gitignore entries

[starlightretailceo]

Adds org-wide .gitignore entries for secrets, credentials, keys, and other sensitive files per Starlight Retail security policy.

[amazon-q-developer]

Review Summary

This PR adds security-focused .gitignore entries to prevent committing sensitive files. The approach is sound, but 3 critical issues must be addressed before merge:

Critical Issues:

1. Overly broad wildcard patterns (*credentials*, *secret*) will accidentally ignore legitimate source code files, potentially excluding critical application code from version control
2. Redundant pattern creates maintenance overhead
3. Missing newline at EOF violates POSIX standards and breaks tooling compatibility

Please address these blocking issues to ensure the .gitignore functions correctly without accidentally excluding legitimate code files.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[amazon-q-developer]

🛑 Security Risk: The wildcard patterns *credentials* and *secret* will match files in all directories and could accidentally ignore legitimate code files. For example, files like user_credentials_validator.py, secret_manager.py, or credentials_test.go would be ignored, potentially excluding critical application code from version control.

Suggested change

	*credentials*
	*secret*
	**/credentials.*
	**/secrets.*
	**/.credentials
	**/.secrets

[amazon-q-developer]

🛑 Logic Error: Line 29 is redundant since line 28 already ignores the entire .idea/ directory. This duplication creates maintenance overhead and potential confusion.

Suggested change

	.idea/
	.idea/workspace.xml
	.idea/

[amazon-q-developer]

🛑 Critical Defect: Missing newline at end of file violates POSIX standards and can cause issues with line-based tools (grep, diff, git) and shell processing. Many CI/CD systems and linters enforce this requirement.

Suggested change

	Thumbs.db
	Thumbs.db

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b3f87f24a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scope secret filename globs to concrete artifacts

The wildcard rules *credentials* and *secret* ignore any new file whose name contains those substrings, including non-sensitive source/docs (for example, credential helpers or secret-management docs), so those files will never show up in git status and can be silently omitted from future commits. Restrict these patterns to known secret file names/locations (or extensions) so legitimate project files are still trackable.

Useful? React with 👍 / 👎.