berth updates

berth/ctrl/vpn.sh

@@ -196,17 +196,7 @@ PY
     return 0
 }
 
-# A .gitignore pattern containing a slash anchors to its own directory, so the
-# only way to know a path is ignored is to ask git.
-assert_ignored() {
-    local path="$1"
-    if ! git check-ignore -q "$path" 2>/dev/null; then
-        echo "REFUSING: '$path' is not gitignored." >&2
-        echo "  Writing key material there would stage it on the next 'git add'." >&2
-        echo "  Verify with: git check-ignore -v $path" >&2
-        exit 1
-    fi
-}
+# assert_ignored lives in lib/estate.sh — host.sh's snapshots need it too.
 
 keygen() {
     local peer="${1:-}"