Fix #880: gitignore .architect-role.md and add update-time backfill

[amrmelsayed]

Summary

Every fresh codev init / codev adopt left a dirty git status the first time the architect spawned — Tower writes .architect-role.md to the workspace root, but the file was missing from CODEV_GITIGNORE_ENTRIES. This PR plugs the day-one gap and adds an update-time backfill so existing Codev projects also self-heal.

Fixes#880

Root Cause

packages/codev/src/lib/scaffold.ts declared the codev-managed gitignore block but omitted .architect-role.md. Sibling builder-runtime files (.builder-role.md, etc.) lived under .builders/<id>/ and were covered transitively, but .architect-role.md lives at workspace root with no ignored ancestor. codev update had no gitignore handling at all, so existing projects had no upgrade path either.

Fix

Part 1 — fresh projects: one-line addition to CODEV_GITIGNORE_ENTRIES. Propagates through FULL_GITIGNORE_CONTENT (init) and the direct append (adopt).

Part 2 — existing projects: new backfillGitignore(targetDir, block, options) in scaffold.ts, wired into codev update.

• Append-only line-level merge — never deletes, reorders, or duplicates.
• Idempotent: a second invocation after a clean state is a no-op.
• Compares on trimmed line equality (avoids false-positive substring matches).
• Missing entries are appended together under # Codev (added by codev update YYYY-MM-DD) so the user can see where they came from.
• Skips silently if no .gitignore exists — creation belongs to init/adopt.
• Honors --dry-run.
• Result surfaced on UpdateResult as gitignoreAdded / gitignoreSkipped; summary line printed in both interactive and agent modes.

Per the issue scope decision, the helper is gitignore-specific (not generalized to a managed-block primitive) — no second use case yet, no premature abstraction.

Test Plan

• Regression tests added (scaffold.test.tsbackfillGitignore block: append, idempotency, custom-entry preservation, dry-run, skip-when-absent, no-duplicates)
• init.test.ts and adopt.test.ts assert .architect-role.md appears in fresh project gitignores
• update.test.ts integration tests for backfill (stale gitignore, dry-run, absent gitignore, idempotent across two updates)
• tsc clean
• Full test suite: 3185 passed | 13 skipped (3198)
• porch check passes both build and tests

[amrmelsayed]

Architect Review

Medium-risk PR (453/9 across 8 files, but only 2 production files — scaffold.ts + update.ts — with the rest being 4 test files + 2 porch bookkeeping). CMAP unanimous (gemini=APPROVE, codex=APPROVE after addressing initial REQUEST_CHANGES on the sentinel bug, claude=APPROVE).

Verified

• Part 1 — .architect-role.md added to CODEV_GITIGNORE_ENTRIES. Regression test should include .architect-role.md (issue #880) asserts it stays in. Propagates through FULL_GITIGNORE_CONTENT (init) and the adopt-side append.
• Part 2 — backfillGitignore(targetDir, block, options) in scaffold.ts with 6 test cases (append, idempotency, custom-entry preservation, dry-run, skip-when-absent, no-duplicates). Wired into codev update with summary line + result fields on UpdateResult.
• Codex's catch (iter-2) — solved a real gap: updateGitignore()'s .agent-farm/-as-sentinel short-circuit meant codev adopt on a project with a partial Codev block would skip backfilling. Replaced with delegation to backfillGitignore() so adopt now does line-level merge too. Strictly better than what the issue body proposed — adopt-vs-update path symmetry, both self-heal partial blocks. Worth remembering for future similar primitives: gitignore-style files need line-level discipline, not all-or-nothing sentinels.
• Test surface complete: scaffold.test.ts (6 backfill cases + CODEV_GITIGNORE_ENTRIES regression), init.test.ts + adopt.test.ts (.architect-role.md presence in fresh gitignores), update.test.ts (backfill integration: stale gitignore, dry-run, absent gitignore, idempotent across two updates). 3185 passed | 13 skipped (3198 total).
• Third-pattern discipline held — backfillGitignore stays gitignore-specific per the issue note; not promoted to a generalized backfillManagedBlock helper. Right call for day one.

Notable design improvement

The codex catch closed a defect the issue body didn't anticipate. The original framing assumed updateGitignore was either "fully owned by Codev" or "completely new" — missed the partial-state case where some Codev entries are already present from an older install. Builder's iter-2 fix makes the entire gitignore-management surface (init → adopt → update) consistently line-level append-only, which is the right invariant.

Verdict

Approved. Please merge with: gh pr merge 881 --merge --admin (solo-architect branch-protection workaround).

---

Architect review