feat: repo create --private - Phase 1 only, never added to cgit

--private makes the gitolite stanza and bare repo but skips the helper
call, so the repo is never written to cgitrc and stays off the public
cgit index (shows PRIV in repo list). --section is required unless
--private. Bash completion offers --private; README and CLAUDE.md
document the flag and the local /usr/local/bin install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/README.md b/README.md
index c8475f3..01b5af7 100644
--- a/README.md
+++ b/README.md
@@ -173,6 +173,7 @@ ssh git_push info                 # gitolite access check
 gitctl sections list
 gitctl sections add "Generic Projects"
 gitctl repo create publisher --section SlackBuilds --desc "..."
+gitctl repo create secrets --private
 gitctl repo list
 gitctl repo desc publisher "a new description"
 gitctl repo add-remote publisher --remote-name origin
@@ -193,6 +194,10 @@ for the SSH key, so it is not fully unattended.
 
 - `repo create` shows the gitolite.conf diff and asks before committing. On
   decline it reverts the conf edit, leaving a clean tree.
+- `--private` creates a Phase 1 only repo: the gitolite stanza and bare repo
+  are made, but the repo is never added to cgitrc, so it stays off the public
+  cgit index. `--section` is not required (and is ignored) with `--private`;
+  the repo shows as `PRIV` in `repo list`.
 - `-y` / `--yes` (a global flag, so it goes BEFORE the subcommand:
   `gitctl -y repo create ...`) skips that y/N confirmation. The diff is still
   printed. It does NOT make creation unattended: the phase-1 push still needs