incoming/.gitkeep als Datei- statt Verzeichnismuster trackbar (schliesst #88)

Files changed:
- .gitignore
- CHANGES.md
- README.md
- VERSION
- incoming/.gitkeep
- instructions/bootstrap.md
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/chemenu/commands/docs_verify.py

.gitignore

@@ -155,19 +155,30 @@ npm-debug.log*
 # one is merely tolerated and ignored; `wikitool raw accept` promotes it into
 # `raw/`, computing the date-sharded directory and any bundle from what was
 # passed in one call. Unlike raw/ itself this must NEVER be committed - the
-# promotion is what makes a file immutable, not the drop - so this is the one
-# directory pattern in this file that is deliberately not anchored back open
-# by the content backstop below.
-/incoming/
+# promotion is what makes a file immutable, not the drop.
+#
+# File pattern, not directory pattern (Gitea #88): `/incoming/` used to
+# exclude the directory itself, and rule 2 above means the negation block at
+# the bottom could never re-include a file whose parent was already gone -
+# so a fresh clone never had the directory at all, only
+# `instructions/bootstrap.md` recreating it by hand. `/incoming/*` excludes
+# everything inside instead, so `!/incoming/.gitkeep` right below actually
+# applies: that one anchor file is trackable and ships with every clone.
+# Nothing else dropped here is rescued by the same rule.
+/incoming/*
+!/incoming/.gitkeep
 
 # MCP `submit` tool quarantine (see raw/CONTRACT.md "Getting a file in from
 # outside" and tools/chemenu/upload.py). Material pushed by a caller that is
 # not this terminal, before a human has reviewed any of it - stronger than
 # `incoming/` above: not merely uncommitted, but read by no command in the
-# ordinary pipeline. No `.gitkeep`: the directory is created on demand by
-# the one function that is allowed to write into it, and a checkout that
-# never arms the `submit` tool never gets one. Never anchored back open by
-# the content backstop below, same as `incoming/`.
+# ordinary pipeline. Unlike `incoming/` above (Gitea #88), this one keeps the
+# directory form and gets no `.gitkeep`: the directory is created on demand
+# by the one function that is allowed to write into it, and a checkout that
+# never arms the `submit` tool never gets one - there is no fresh-clone case
+# to cover here, since nothing reads this path before that function creates
+# it. Never anchored back open by the content backstop below, same as
+# `incoming/`.
 /mcp-upload/
 
 # Content backstop - keep this block last. Nothing under raw/, kb/ or work/ may