feat(setup-interns, using-interns): secrets at ~/.config/projects-secrets/

Aligns claude-skills with secrets-out-of-common etap-1 migration: the
canonical home for plain-text local-dev secrets is now ~/.config/projects-secrets/,
outside any git tree.

setup-interns [v0.3.0 → v0.4.0, MINOR — write target changed]:
- Phase 1 drops gitignore-sanity check (no longer needed)
- Phase 2 plan block drops Gitignore line
- Phase 3 backs up ~/.config/projects-secrets/interns.env if present
- Phase 5 writes ~/.config/projects-secrets/interns.env (mkdir -p ahead)
- Phase 6 cwd documentation: secrets path no longer relative to cwd; uses
  INTERNS_SECRETS_PATH env var (or ~/.config default) — independent
- Common-mistakes drops "missing gitignore rule" entry

using-interns [v0.2.0 → v0.2.1, PATCH — wording]:
- Always-ask paths section reflects new canonical secrets home
- Prerequisites text updates setup-interns write target

interns-design.md (wiki concept): path refs updated for ASCII layer
  diagram, Layer 1 example block, Phase 5 description, comparison
  table, and final cross-cutting note. **/projects-secrets/** added
  to always-ask documentation pattern.

dist/: setup-interns.skill + using-interns.skill rebuilt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

skills/using-interns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: using-interns
-version: 0.2.0
+version: 0.2.1
 description: Use when delegating predictable bulk reads or summarization to cheap intern LLMs via the local `interns` MCP server (`mcp__interns__bulk_text_read`, `mcp__interns__transcript_distill`, etc.) so Claude saves Anthropic quota. Activated by `delegate to interns when allowed` in CLAUDE.md or explicit phrases like "use interns", "delegate to an intern", "разреши интернов", "allow interns". Per-session permission grant mirrors `project-discipline` Rule 4: ask-mode default, conversational grant / revoke, always-ask paths for `.env` / secrets / keys / SSH / credentials even with active grant, transitive rule (Claude can't bypass by reading the file itself and forwarding content), session-end reset. Skip for architecture, debugging, auth / payments, final commit messages, or final user-facing text.
 ---
 
@@ -22,7 +22,7 @@ All currently run on Ollama Cloud (`deepseek-v4-flash`, ~$0.002 / call). Adding
 
 ## Prerequisites
 
-This skill assumes `mcp__interns__*` tools are available. If they aren't (tools missing from the session, or calls fail with a connection error), the server isn't running for this session. Trigger the **`setup-interns`** skill to `pip install -e` the runtime, write `.common/secrets/interns.env`, and register `mcpServers.interns` in `~/.claude.json`. It's a one-time procedure with confirmation gates.
+This skill assumes `mcp__interns__*` tools are available. If they aren't (tools missing from the session, or calls fail with a connection error), the server isn't running for this session. Trigger the **`setup-interns`** skill to `pip install -e` the runtime, write `~/.config/projects-secrets/interns.env`, and register `mcpServers.interns` in `~/.claude.json`. It's a one-time procedure with confirmation gates.
 
 ## When to use
 
@@ -79,7 +79,7 @@ The next session starts in ask-mode regardless of prior grants. Same reasoning a
 These never go to an intern silently, even when delegation is granted:
 
 - `**/.env`, `**/.env.*`
-- `**/secrets/**` (including `.common/secrets/`, `~/.config/projects-mcp/`)
+- `**/secrets/**`, `**/projects-secrets/**` (including `~/.config/projects-secrets/`, `~/.config/projects-mcp/`)
 - `**/credentials*`, `**/credentials.json`
 - `**/*.key`, `**/*.pem`
 - `**/.ssh/**`