tasks(iis-migration-to-ruvds): pause после failed-robocopy + ingest SMB-default finding

Temp admin (2026-05-23 09:37-18:08) начал импл iis-migration-to-ruvds,
не закончил bootstrap, упал на UNC robocopy (exit 16) и dropped tree dirty.

Session recovery:
- secrets leak fix: `.secrets/ruvds-iis.env` → `pass show ruvds-iis/full-env`
  (etap-2 discipline restored). `.secrets/` + `*.env` + `*-log.txt` + `*-size.txt`
  added to `.gitignore` чтобы не повторилось.
- root cause зафиксирован: TCP/445 closed по дефолту на fresh Win Server 2025
  Core + SMB share не создан → UNC robocopy не работает без RUVDS bootstrap.
- new concept `windows-server-2025-core-bootstrap.md` — default-blockers
  table + transfer-методов матрица (RDP-redirect / SMB / WinRM / SFTP) +
  bootstrap-чеклист 12 шагов. Recommendation = SMB inbound с source-IP
  whitelist.
- task ⚪ → 🟡 paused с concrete next-step (capacity audit, transfer-method
  confirm, RUVDS bootstrap, backup source, recreate IIS sites + conn-string
  swap, pilot kupimknigi + DNS swap).
- Open question raised: source 11 sites сумма vs RUVDS 30 GB HDD — capacity
  blocker possible (snolla одна 8.66 GB).

Не push'нуто — ждёт user grant per project-discipline Rule 4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -11,3 +11,12 @@ Thumbs.db
 *~
 .vscode/
 .idea/
+
+# Secret material — должны жить в `pass`, не в repo (даже untracked).
+.secrets/
+*.env
+!*.env.example
+
+# Transient operational drops — findings captured в .tasks/, не в repo root.
+*-log.txt
+*-size.txt