Protect private bank configuration from drift reconciliation (Refs #152)

src/lib/server/provisioning/activation-files.ts

@@ -1,3 +1,4 @@
+import { assertPublicFileTarget } from '../fleet/private-config.js';
 import { db } from '../db/index.js';
 import { blobSize, getFileBlob } from '../db/file-blobs.js';
 import type { LaunchRecipePlan } from '../fleet/launch-recipes.js';
@@ -22,6 +23,7 @@ export function applyActivationFiles(
         version: number | null;
     })[];
     for (const change of changes) {
+        assertPublicFileTarget(change.server, change.kind, change.rel_path);
         if (change.kind !== 'script' && change.kind !== 'config' && change.kind !== 'plugin')
             throw new Error('File activation requires a runtime file kind.');
         recipe.files = recipe.files.filter(