feat: close the change-2 secret-blocking gaps

[nimser]

Closes the remaining gaps of private/openspec/changes/change-2-secret-blocking on top of the steering-first branch (stacked — retarget to main after #16's successor merges, or it will auto-retarget when the base branch is deleted).

What

• ssh-private-key predicate rule (private-key.read-ssh-dir): blocks any non-public file under .ssh/, allowlisting config, known_hosts, authorized_keys, and *.pub/*.pubkey. Fixes a false positive: the previous regex /\.ssh/(?!.*\.pub$) blocked ~/.ssh/config and known_hosts.
• Hardening redirect rules: < sensitive-file reads, >/>> writes, and tee to .env/.pem/.key files.
• nonOverridable: true pack metadata (type + YAML loader passthrough), set on hardening per ADR-007. Declarative only for now — enforcement lands with the config override system (change-13).
• Docs: regenerated docs/packs.md gallery, documented nonOverridable in docs/rule-pack-guide.md.

How

TDD: three failing tests added to src/packs/packs.test.ts first, then the minimal implementation. 240/240 tests pass, typecheck and lint clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XLCHSd4NWR45fF5atExsbf

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b7d16dc5-0b32-4767-9fc6-00ebfa77b21e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/change-2-secret-blocking-gap

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
96.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nimser]

Superseded by the standalone change-2 slice PR (change-2-secret-blocking → main); its diff is fully carried over there.