R-1133 closed as accepted (option A): ~/.docker/config.json joins the guard's read-refusal list (cc-secrets 0.2.2); 174 rows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/audits/cc-creds-build-2026-10-17/redproof.txt

@@ -21,6 +21,7 @@ RED    rules: a leading sec run exempts every segment          -> FAILED (failur
 RED    rules: the child of sec run is not checked              -> FAILED (failures=7)    restored=True
 RED    rules: option B not applied                             -> FAILED (failures=5)    restored=True
 RED    run: unloaded stored names reach the child              -> FAILED (failures=1)    restored=True
+RED    rules: docker config not protected                      -> FAILED (failures=4, errors=1) restored=True
 RED    install: foreign hooks dropped                          -> FAILED (failures=1)    restored=True
 RED    install: malformed settings overwritten                 -> FAILED (failures=1)    restored=True
 after all restores, full suite: OK