Standardize PEM paths to shared k8s Secret mount

All agents now reference PEMs at /paperclip/secrets/github-pems/<name>.pem
instead of per-agent secrets/ subdirectories. PEMs will be mounted from a
single Kubernetes Secret. Added .gitignore to prevent accidental secret commits.

Countess GitHub App ID set to 3097914.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ceo/CONFIG.md

@@ -31,8 +31,8 @@
 {
   "cwd": "/paperclip/privilegedescalation/ceo",
   "env": {
-    "GITHUB_APP_ID_COUNTESS": { "type": "plain", "value": "<TODO: create GitHub App and set ID>" },
-    "GITHUB_PEM_PATH_COUNTESS": { "type": "plain", "value": "/paperclip/privilegedescalation/ceo/secrets/github-app.pem" }
+    "GITHUB_APP_ID_COUNTESS": { "type": "plain", "value": "3097914" },
+    "GITHUB_PEM_PATH_COUNTESS": { "type": "plain", "value": "/paperclip/secrets/github-pems/countess.pem" }
   },
   "model": "claude-opus-4-6",
   "graceSec": 15,