harden installers: pin curl to https + gitignore filter-repo secrets artifact

- Add --proto '=https' --proto-redir '=https' to all live curl download
  commands (design UI/UX skill, whisper model, copywriting + watch skill
  files) so a hijacked redirect cannot downgrade the transfer to cleartext.
- Ignore .filter-repo-replacements.txt: the git-filter-repo artifact that
  records previously-scrubbed secret replacements must never be committed.

Author: fidgetcoding

.gitignore

@@ -49,3 +49,7 @@ renders/
 *.m4a
 whisper-cache/
 .mailmap
+
+# git-filter-repo artifact — records previously-scrubbed secret replacements
+# (old value → replacement). Must never be committed; delete after review.
+.filter-repo-replacements.txt

copywriting/install.sh

@@ -82,7 +82,7 @@ install_copywriting_skill() {
         local rel="$1"
         local dest="$2"
         local tmp="$dest.tmp"
-        if curl -fsSL "$BASE_URL/$rel" -o "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
+        if curl -fsSL --proto '=https' --proto-redir '=https' "$BASE_URL/$rel" -o "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
             mv "$tmp" "$dest"
             return 0
         fi

design/install.sh

@@ -91,7 +91,7 @@ install_uiux_skill() {
     local UIUX_SHA256="1c8b62068136ce3af4f6fe8d990a7da79b7ec6fd837c760b5ded4833b9756779"
 
     local SKILL_TMP="$SKILL_DIR/SKILL.md.tmp"
-    if curl -fsSL "$SKILL_URL" -o "$SKILL_TMP" 2>/dev/null && [ -s "$SKILL_TMP" ]; then
+    if curl -fsSL --proto '=https' --proto-redir '=https' "$SKILL_URL" -o "$SKILL_TMP" 2>/dev/null && [ -s "$SKILL_TMP" ]; then
         # Verify integrity before accepting the file
         local _sha=""
         if command -v shasum &>/dev/null; then

media/install.sh

@@ -360,7 +360,7 @@ install_whisper_model_basen() {
     info "  Source: $MODEL_URL"
     info "  Checksum: server-side LFS only (HuggingFace does not publish a content SHA256)"
 
-    if ! curl -fL --retry 2 --connect-timeout 15 "$MODEL_URL" -o "$MODEL_FILE" 2>/dev/null; then
+    if ! curl -fL --proto '=https' --proto-redir '=https' --retry 2 --connect-timeout 15 "$MODEL_URL" -o "$MODEL_FILE" 2>/dev/null; then
         rm -f "$MODEL_FILE"
         WHISPER_MODEL_STATUS="FAILED"
         soft_fail "Whisper base.en model download failed. Install manually:

watch/install.sh

@@ -84,7 +84,7 @@ install_watch_skill() {
         local dest="$2"
         local tmp="$dest.tmp"
         mkdir -p "$(dirname "$dest")"
-        if curl -fsSL "$BASE_URL/$rel" -o "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
+        if curl -fsSL --proto '=https' --proto-redir '=https' "$BASE_URL/$rel" -o "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
             mv "$tmp" "$dest"
             return 0
         fi