berth updates

berth/.gitignore

@@ -19,3 +19,8 @@ def/
 # slash resolves against this file's own directory. `git check-ignore -v` is the
 # only way to confirm it, and ctrl/vpn.sh refuses to write a key until it does.
 ctrl/.secrets/
+
+# Snapshots of a remote box's state (`host.sh snapshot --run`). Not secrets —
+# the probe refuses to read environments, compose files or logs — but machine
+# state from production, and never source. Anchored to ctrl/ for the reason above.
+ctrl/.snapshots/