Protect private bank configuration from drift reconciliation (Refs #152)

src/lib/server/fleet/scripts.ts

@@ -1,3 +1,4 @@
+import { isReservedConfigFilename } from './private-config.js';
 import { scriptVersionError } from '../../script-version.js';
 import { putFileBlob, blobContent } from '../db/file-blobs.js';
 import { createHash } from 'node:crypto';
@@ -62,6 +63,7 @@ export class ScriptError extends Error {
             | 'name-empty'
             | 'name-taken'
             | 'path-empty'
+            | 'path-reserved'
             | 'no-such-script'
             | 'no-such-version'
             | 'invalid-scope'
@@ -249,6 +251,11 @@ export function createScript(input: CreateScriptInput): {
         );
     }
     if (!targetRelPath) throw new ScriptError('target rel path is required', 'path-empty');
+    if (isReservedConfigFilename(targetRelPath))
+        throw new ScriptError(
+            'electric_cherry_bank.cfg is reserved for instance credentials.',
+            'path-reserved'
+        );
 
     // Kind-specific validation.
     if (kind === 'baseline') {