Nice guide. One problem though: with showUntrackedFiles=no, the only thing protecting you from "add -A" is habit. In a bare repo you can put a deny list in ~/.dotfiles/info/exclude (.ssh/, .aws/, .env, *.local, .zsh_history), and git will skip those files even on add -A.