VM121 Git filesystem inventory v2

RESULT=PASS_VM121_GIT_FILESYSTEM_INVENTORY_V2_READONLY
VM121_MODIFIED=false

SOURCE_FILE_COUNT=73
SOURCE_SYMLINK_COUNT=0
SYSTEMD_UNIT_COUNT=11
EXTERNAL_TOOL_COUNT=8
BUILD_SOURCE_COUNT=3
SENSITIVE_PATH_COUNT=21

EXCLUDED_RUNTIME_FILE_COUNT=1027
EXCLUDED_STATUS_FILE_COUNT=1

REPORT_SHA256=5405dc4a339d0da364424bf7ec7a1005a9439ee52f0becd415b04fcd2b051deb

Corrections from the first inventory attempt:
- /opt/wg-access/runtime is explicitly excluded
- /opt/wg-access/status is explicitly excluded
- trigger event files are not hashed or treated as source
- systemd grep with no extra matches cannot abort under pipefail

Reviewed source classes:
- backend and agent application source
- Docker and compose definitions
- migrations and dependency manifests
- systemd services, timers and path units
- reconcile, expire, watcher and maintenance tools

Explicitly excluded from source:
- runtime trigger events
- checkpoint/status output
- .env and credentials
- SSH and WireGuard keys
- database data and dumps
- logs, caches, virtual environments and build products

No file, package, service, Git repository or runtime state
was changed on VM121.