feat(P01): nova init scaffold (REQ-325, cli-engineer)

- core/init_scaffold.py: scaffold(root, force) creates .nova/,
  .nova/contract.yml.attestations/, and appends secrets-exclusion lines
  to .gitignore (~/.nova/credentials.json, .nova/credentials.json,
  *.pem, *.key, .env, .env.*). Refuses overwrite without --force.
- nova/init.py: thin subcommand parsing --force, delegates to
  core.init_scaffold.scaffold.

---ci---
project: acdl
phase: 1
milestone: v1.28
status: execute
persona: cli-engineer
---/ci---

core/init_scaffold.py

@@ -0,0 +1,51 @@
+"""Nova init scaffolding logic (P1, REQ-325).
+
+Creates .nova/ directory structure + secrets-exclusion .gitignore lines
+in the current working directory. nova/init.py delegates here so the
+subcommand stays thin (≤50 lines, ≤3 functions).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+SECRETS_IGNORE_LINES = (
+    "~/.nova/credentials.json",
+    ".nova/credentials.json",
+    "*.pem",
+    "*.key",
+    ".env",
+    ".env.*",
+)
+
+
+def _ensure_gitignore(root: Path, force: bool) -> None:
+    gi = root / ".gitignore"
+    existing = gi.read_text().splitlines() if gi.is_file() else []
+    additions = [ln for ln in SECRETS_IGNORE_LINES if ln not in existing]
+    if not additions:
+        return
+    blob = gi.read_text() if gi.is_file() else ""
+    if blob and not blob.endswith("\n"):
+        blob += "\n"
+    blob += "\n".join(additions) + "\n"
+    gi.write_text(blob)
+
+
+def scaffold(root: Path | None = None, force: bool = False) -> int:
+    """Create .nova/ + .nova/contract.yml.attestations/ + .gitignore lines."""
+    root = root or Path.cwd()
+    nova_dir = root / ".nova"
+    attest_dir = nova_dir / "contract.yml.attestations"
+    if nova_dir.exists() and not force:
+        print(f"refusing: {nova_dir} already exists (use --force to overwrite)")
+        return 1
+    nova_dir.mkdir(parents=True, exist_ok=True)
+    attest_dir.mkdir(parents=True, exist_ok=True)
+    _ensure_gitignore(root, force)
+    print(f"scaffolded: {nova_dir} (+ {attest_dir.name}/, .gitignore secrets)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(scaffold())

nova/init.py

@@ -0,0 +1,20 @@
+"""nova init — scaffold .nova/ + secrets .gitignore (P1, REQ-325)."""
+
+from __future__ import annotations
+
+from core.init_scaffold import scaffold
+
+
+def add_parser(subparsers):
+    p = subparsers.add_parser("init", help="scaffold .nova/ + .gitignore in cwd")
+    p.add_argument("--force", action="store_true", help="overwrite existing .nova/")
+    p.set_defaults(_run=run)
+
+
+def run(args) -> int:
+    return scaffold(force=args.force)
+
+
+if __name__ == "__main__":
+    import sys
+    print("use: nova init [--force]", file=sys.stderr)