feat: repo create --private - Phase 1 only, never added to cgit

--private makes the gitolite stanza and bare repo but skips the helper
call, so the repo is never written to cgitrc and stays off the public
cgit index (shows PRIV in repo list). --section is required unless
--private. Bash completion offers --private; README and CLAUDE.md
document the flag and the local /usr/local/bin install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 7146290..1342973 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,6 +10,8 @@ Two single-file scripts, no shared module:
 
 - `gitctl`: client, runs on the laptop. Dumb caller: loads TOML config, edits
   the local gitolite-admin clone and pushes, shells out to the helper over SSH.
+  Installed locally at `/usr/local/bin/gitctl` (the user copies it there by
+  hand; not done by this repo).
 - `gitctl-helper`: server helper, runs as the git user over a `command=`-restricted
   SSH key. Holds all parsing-heavy logic. Dispatches on `SSH_ORIGINAL_COMMAND`.
 
@@ -57,6 +59,11 @@ separate `AuthorizedKeysFile` (`~git/.ssh/gitctl_keys`) wired via a
 - **`description` file is owned `git:gitolite3`** (system user git, group gitolite3,
   no gitolite3 user). `set-desc` writes in place (truncate-write) to preserve owner,
   with `os.chown` back as insurance.
+- **`repo create --private` runs Phase 1 only.** It makes the gitolite stanza
+  and bare repo but never calls the helper, so the repo is never written to
+  cgitrc and stays off the public cgit index (shows `PRIV` in `repo list`).
+  `--section` is required unless `--private` (enforced in `cmd_create`, not
+  argparse, since the rule is conditional).
 - Every operation is idempotent and safe to re-run.
 - No em dashes in user-facing text.
 - Work on `master`, no feature branches.