fix(security): keep environment templates untracked

docs/deploy/systemd/openclaw.env

@@ -1,20 +0,0 @@
-# /etc/default/openclaw.env
-# Secure environment configuration for OpenClaw
-
-# Admin Token (Required for remote ops)
-OPENCLAW_ADMIN_TOKEN=change-me-to-a-strong-secret
-
-# Observability Token (Required for remote logs)
-# (Legacy: MOLTBOT_OBSERVABILITY_TOKEN)
-OPENCLAW_OBSERVABILITY_TOKEN=change-me-too
-
-# Bridge (Default: 0/Disabled)
-OPENCLAW_BRIDGE_ENABLED=0
-# OPENCLAW_BRIDGE_DEVICE_TOKEN=
-
-# Optional startup log hygiene (truncate openclaw.log once per process start)
-# OPENCLAW_LOG_TRUNCATE_ON_START=1
-
-# Network
-# Bind to localhost by default
-COMFYUI_LISTEN=127.0.0.1

docs/deploy/systemd/openclaw.env.example

@@ -0,0 +1,19 @@
+# Copy this public template to /etc/default/openclaw.env before starting the service.
+# Replace every placeholder locally; never commit the deployed environment file.
+
+# Admin Token (required for remote operations)
+OPENCLAW_ADMIN_TOKEN=replace-with-a-strong-secret
+
+# Observability Token (required for remote logs)
+# Legacy name: MOLTBOT_OBSERVABILITY_TOKEN
+OPENCLAW_OBSERVABILITY_TOKEN=replace-with-an-observability-secret
+
+# Bridge (default: disabled)
+OPENCLAW_BRIDGE_ENABLED=0
+# OPENCLAW_BRIDGE_DEVICE_TOKEN=
+
+# Optional startup log hygiene (truncate openclaw.log once per process start)
+# OPENCLAW_LOG_TRUNCATE_ON_START=1
+
+# Bind to localhost by default
+COMFYUI_LISTEN=127.0.0.1

tests/test_gitignore_tracking_boundary.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import subprocess
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+
+
+class TestGitignoreTrackingBoundary(unittest.TestCase):
+    def test_no_tracked_path_is_ignored(self):
+        result = subprocess.run(
+            ["git", "ls-files", "-ci", "--exclude-standard"],
+            cwd=REPO_ROOT,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+
+        self.assertEqual(result.returncode, 0, msg=result.stderr)
+        ignored_tracked_paths = [
+            line.strip() for line in result.stdout.splitlines() if line.strip()
+        ]
+        self.assertEqual(ignored_tracked_paths, [])
+
+
+if __name__ == "__main__":
+    unittest.main()