move conf templates and conf_populate to Deployment/; add rogue-prevention rules to CLAUDE.md

git_pull_execute.sh

@@ -282,6 +282,7 @@ echo "━━━ $ICON_GEAR Conf Upgrade ━━━"
 
 UPGRADE_SCRIPT="$TARGET_DIR/Deployment/conf_upgrade.sh"
 CONF_DIR="$TARGET_DIR/Configurations"
+DEPLOY_DIR="$TARGET_DIR/Deployment"
 
 if [[ ! -f "$UPGRADE_SCRIPT" ]]; then
     log "conf_upgrade.sh not found — skipping (pre-deployment-folder repo)"
@@ -291,9 +292,9 @@ elif [[ "$SYNC_SUCCESS" == true ]]; then
     _DRY=""
 
     # master.conf
-    if [[ -f "$CONF_DIR/master.conf.template" && -f "$CONF_DIR/master.conf" ]]; then
+    if [[ -f "$DEPLOY_DIR/master.conf.template" && -f "$CONF_DIR/master.conf" ]]; then
         bash "$UPGRADE_SCRIPT" \
-            --template "$CONF_DIR/master.conf.template" \
+            --template "$DEPLOY_DIR/master.conf.template" \
             --target   "$CONF_DIR/master.conf" \
             --backup   $_DRY
     else
@@ -302,11 +303,11 @@ elif [[ "$SYNC_SUCCESS" == true ]]; then
 
     # This server's host conf only — sparse checkout ensures we have it
     HOST_CONF="$CONF_DIR/${MY_ID,,}.conf"
-    if [[ -f "$CONF_DIR/host.conf.template" && -f "$HOST_CONF" ]]; then
+    if [[ -f "$DEPLOY_DIR/host.conf.template" && -f "$HOST_CONF" ]]; then
         # Template uses HOSTN_ as generic prefix. Substitute MY_ID before merging
         # so keys match the target (HOST1_* or HOST2_*) and real values are preserved.
         TMPL_RESOLVED=$(mktemp)
-        sed "s/HOSTN_/${MY_ID}_/g; s/REMOTE_ID/${REMOTE_ID}/g" "$CONF_DIR/host.conf.template" > "$TMPL_RESOLVED"
+        sed "s/HOSTN_/${MY_ID}_/g; s/REMOTE_ID/${REMOTE_ID}/g" "$DEPLOY_DIR/host.conf.template" > "$TMPL_RESOLVED"
         bash "$UPGRADE_SCRIPT" \
             --template "$TMPL_RESOLVED" \
             --target   "$HOST_CONF" \