chore(ci): generated-file gate + gitignore normalization (P6-E11-W2-S2-T13)

.github/workflows/generated-file-gate.yml

@@ -0,0 +1,59 @@
+name: Generated File Gate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  generated-file-gate:
+    name: Block committed generated files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan diff for GENERATED BY markers
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch origin main --depth=1
+            BASE="origin/main"
+          else
+            BASE="${{ github.event.before }}"
+            if [ -z "$BASE" ] || ! git cat-file -e "$BASE" 2>/dev/null; then
+              BASE="HEAD~1"
+            fi
+          fi
+
+          CHANGED=$(git diff --name-only "$BASE"...HEAD || true)
+          if [ -z "$CHANGED" ]; then
+            echo "No changed files to scan."
+            exit 0
+          fi
+
+          FAIL=0
+          while IFS= read -r f; do
+            [ -f "$f" ] || continue
+            if head -n 5 "$f" | grep -q "# GENERATED BY"; then
+              if git check-ignore -q "$f"; then
+                echo "OK: $f is generated but gitignored."
+              else
+                echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
+                echo "  -> $f"
+                FAIL=1
+              fi
+            fi
+          done <<< "$CHANGED"
+
+          if [ "$FAIL" -eq 1 ]; then
+            echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
+            exit 1
+          fi
+
+          echo "Generated File Gate: clean."

.gitignore

@@ -171,3 +171,5 @@ android/app/build/
 *.hprof
 *.jks
 pnpm-lock.yaml
+*.generated.env
+**/*.gen.yml