security(#305): gitignore session profiles/spool; drop hardcoded operator paths

[nolanmak]

Closes #305.

Prevents committing live session-cookie profiles/spools and removes committed operator PII (which also broke macOS).

• .gitignore: adds **/chrome-profile/, **/*-chrome-profile/, .env.*, augmentagent-webhooks.jsonl, augmentagent-deft-seen.jsonl (verified via git check-ignore).
• sidecars/grocery/src/server.ts: SCHEDULE_HELPER/NODE_BIN now env/process.execPath-derived (fixes macOS).
• systemd/*.service (×5): hardcoded /home/nolan-makatche → %h.
• reasoner.rs: operator name scrubbed from a test fixture (path shape preserved so sanitizer tests still hold).

No Linux behavior change; grocery paths now resolve on macOS too.

Verification: git check-ignore confirms all 5 patterns ignored; cargo check -p augmentagent-channel-core passes.

Follow-up (out of scope): scripts/grocery-schedule.mjs still has /home/nolan-makatche paths (the WEEKLY_SCRIPT const + embedded unit templates) — derive from import.meta.url/os.homedir() in a follow-up.

🤖 swarm-authored, human-review-required (draft).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c5cdf0e5-8515-4485-9e85-fbbd89e27d4c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sec/305-gitignore-pii

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}