Keep the ignore policy for tracked files in full snapshots

git status reports edits to tracked files that match .gitignore. The listed-file path filtered them with git check-ignore --no-index; the full-snapshot path did not, so a committed template filled with a local secret was copied verbatim into the shadow snapshot. Every snapshot now filters its changed files the same way (failing closed); an ignored file an earlier snapshot captured is reset to its base content.