DEFAULT_PROTECTED

Read-only by default: git metadata, env files, keys and secrets (as in Pydantic AI Harness).