chore: ignore materialized Paperclip runtime directory

Adds .paperclip-runtime/ to .gitignore so the materialized adapter credentials directory is never accidentally committed.

.gitignore

@@ -45,6 +45,7 @@ diagnostics/
 .vscode/
 .claude/settings.local.json
 .paperclip-local/
+.paperclip-runtime/
 /.idea/
 /.agents/
 

packages/shared/src/gitignore-runtime.test.ts

@@ -0,0 +1,18 @@
+import { execSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+// packages/shared/src/ is three levels below the repo root
+const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
+
+describe("gitignore: .paperclip-runtime/", () => {
+  it("ignores files under .paperclip-runtime/ via the explicit gitignore rule", () => {
+    const output = execSync(
+      "git check-ignore -v .paperclip-runtime/codex/home/auth.json",
+      { cwd: REPO_ROOT, encoding: "utf8" },
+    ).trim();
+    // Output format: <source>:<line>:<pattern>\t<path>
+    // Asserts that the rule comes from .gitignore and matches .paperclip-runtime/
+    expect(output).toMatch(/^\.gitignore:\d+:\.paperclip-runtime\//);
+  });
+});