Move private runtime state outside checkouts and isolate worktrees

tests/test_cli_command_system.py

@@ -192,6 +192,10 @@ def test_doctor_reports_presence_without_exposing_values(tmp_path, monkeypatch):
         },
     )
 
+    from napseer_credentials import CredentialStore
+    store = CredentialStore(state_dir)
+    store.migrate()
+    auth_path = store.project
     result = module.doctor_status()
     serialized = json.dumps(result)