feat(setup-interns, using-interns): secrets at ~/.config/projects-secrets/

Aligns claude-skills with secrets-out-of-common etap-1 migration: the
canonical home for plain-text local-dev secrets is now ~/.config/projects-secrets/,
outside any git tree.

setup-interns [v0.3.0 → v0.4.0, MINOR — write target changed]:
- Phase 1 drops gitignore-sanity check (no longer needed)
- Phase 2 plan block drops Gitignore line
- Phase 3 backs up ~/.config/projects-secrets/interns.env if present
- Phase 5 writes ~/.config/projects-secrets/interns.env (mkdir -p ahead)
- Phase 6 cwd documentation: secrets path no longer relative to cwd; uses
  INTERNS_SECRETS_PATH env var (or ~/.config default) — independent
- Common-mistakes drops "missing gitignore rule" entry

using-interns [v0.2.0 → v0.2.1, PATCH — wording]:
- Always-ask paths section reflects new canonical secrets home
- Prerequisites text updates setup-interns write target

interns-design.md (wiki concept): path refs updated for ASCII layer
  diagram, Layer 1 example block, Phase 5 description, comparison
  table, and final cross-cutting note. **/projects-secrets/** added
  to always-ask documentation pattern.

dist/: setup-interns.skill + using-interns.skill rebuilt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

skills/setup-interns/README.md

@@ -1,6 +1,6 @@
 # setup-interns
 
-One-time skill that brings up the local `interns` MCP server on a new (or freshly broken) machine. Detects the runtime source at `<project-root>/.common/lib/interns-mcp/`, runs `pip install -e`, writes `.common/secrets/interns.env` with the endpoint API keys, and registers `mcpServers.interns` in `~/.claude.json`.
+One-time skill that brings up the local `interns` MCP server on a new (or freshly broken) machine. Detects the runtime source at `<project-root>/.common/lib/interns-mcp/`, runs `pip install -e`, writes `~/.config/projects-secrets/interns.env` with the endpoint API keys, and registers `mcpServers.interns` in `~/.claude.json`.
 
 The runtime policy for *using* the resulting tools lives in [`using-interns`](../using-interns/) — `setup-interns` is the only place that touches user-level config or the project's secrets directory.
 
@@ -21,7 +21,7 @@ Full design (Layer 1 / 2 / 3, MVP catalog, always-ask paths, routing hints):
 |---|---|
 | `<project-root>/.common/lib/interns-mcp/` | server source (must already exist; not created here) |
 | `<project-root>/.common/config/interns/config.yaml` | catalog of interns + endpoints (read-only here) |
-| `<project-root>/.common/secrets/interns.env` | endpoint API keys (gitignored) |
+| `~/.config/projects-secrets/interns.env` | endpoint API keys (outside any git tree) |
 | `~/.claude.json` (`mcpServers.interns`) | MCP registration |
 | `pip` site-packages | editable install of `interns_mcp` |
 
@@ -36,11 +36,11 @@ Full design (Layer 1 / 2 / 3, MVP catalog, always-ask paths, routing hints):
 ## Procedure (high-level)
 
 1. **Phase 0** — environment sanity (`python` ≥ 3.11, `pip`, network to endpoints).
-2. **Phase 1** — discovery (source / module / config / keys / MCP registration / `.gitignore`).
+2. **Phase 1** — discovery (source / module / config / keys / MCP registration).
 3. **Phase 2** — plan + confirm. Wait for explicit "ok" / "go" / "поехали".
-4. **Phase 3** — backup (`~/.claude.json`, existing `.common/secrets/interns.env`).
+4. **Phase 3** — backup (`~/.claude.json`, existing `~/.config/projects-secrets/interns.env`).
 5. **Phase 4** — `pip install -e .common/lib/interns-mcp/`.
-6. **Phase 5** — write `.common/secrets/interns.env` (per-key, missing-only) + ensure `.gitignore` rule.
+6. **Phase 5** — write `~/.config/projects-secrets/interns.env` (per-key, missing-only).
 7. **Phase 6** — register `mcpServers.interns` in `~/.claude.json` with absolute interpreter path + `cwd`.
 8. **Phase 7** — best-effort smoke test (in-session caveat: real verification is after restart).
 9. **Phase 8** — restart guidance + final report.
@@ -50,7 +50,7 @@ Full procedure with shell snippets and templates lives in [`SKILL.md`](SKILL.md)
 ## Rollback
 
 1. Stop. Don't fix forward.
-2. `cp <file>.bak-<ts> <file>` for `~/.claude.json` and `.common/secrets/interns.env`.
+2. `cp <file>.bak-<ts> <file>` for `~/.claude.json` and `~/.config/projects-secrets/interns.env`.
 3. Optional: `pip uninstall interns-mcp` to undo the editable install.
 4. Restart Claude Code.
 5. Confirm `mcp__interns__*` tools are gone (or back to the prior version).