fix: update verify script to check git tracking, not file existence

The verification script was incorrectly flagging .env files that exist locally
but are properly gitignored. Now checks if files are tracked by git using
'git ls-files' instead of just checking file existence.

This prevents false positives when .env is in .gitignore and exists locally
for development but is not committed to the repository.

scripts/verify-guidelines.sh

@@ -123,10 +123,22 @@ section "General: No secrets committed"
 
 # GUIDELINE: NEVER commit files with secrets (.env, credentials.json, etc.)
 echo "Checking for secrets in repository..."
-if [ -f ".env" ] || [ -f "credentials.json" ]; then
-    error_msg "Found .env or credentials.json in repository (violation: secrets committed)"
+if git rev-parse --git-dir > /dev/null 2>&1; then
+    TRACKED_SECRETS=$(git ls-files | grep -E "^\.env$|^credentials.json$" || true)
+    if [ -n "$TRACKED_SECRETS" ]; then
+        error_msg "Found .env or credentials.json tracked in git (violation: secrets committed)"
+        echo "Tracked files:"
+        echo "$TRACKED_SECRETS"
+    else
+        success_msg "No secrets in repository"
+    fi
 else
-    success_msg "No secrets in repository"
+    # No git repo, just check if files exist
+    if [ -f ".env" ] || [ -f "credentials.json" ]; then
+        warning_msg ".env or credentials.json exist locally (ensure they're .gitignored)"
+    else
+        success_msg "No secrets in repository"
+    fi
 fi
 
 echo "Checking git history for secrets..."