升级本机 Trellis 至 0.6.12（upgrade-trellis-0-6-12）

.trellis/spec/hyb-oa/project-governance.md

@@ -125,6 +125,11 @@ recorded in task `07-26-small-team-internal-oa-review`.
   `--force` to erase `workflow.md`, `config.yaml`, `.gitignore` or `AGENTS.md`.
 - Treat dry-run output and manifest cleanliness as evidence, but do not assume
   a dry-run is write-free; inspect `git status` before and after it.
+- `trellis update` may copy ignored, local-only platform settings into the new
+  `.trellis/.backup-<timestamp>/`. Keep that exact backup only through the
+  merge/rollback window, then remove it before the sensitive-content gate once
+  Git and the pinned prior CLI provide the rollback path. Do not weaken the
+  scanner and do not blanket-delete older backups outside the task scope.
 
 ### 4. Validation & Error Matrix
 
@@ -134,6 +139,9 @@ recorded in task `07-26-small-team-internal-oa-review`.
   discovery, and rerun the preview.
 - `.new` conflict files remain -> upgrade is incomplete; merge or discard each
   one deliberately.
+- Sensitive scan reports a complete local path inside the newly created
+  upgrade backup -> resolve the exact backup from this run, remove it after the
+  merge is stable, and rerun the scan; an ignored directory is still scanned.
 - Post-upgrade dry-run changes manifest again -> investigate template hash drift
   before commit.
 - No active task directory after the last task is archived -> valid idle state;
@@ -157,8 +165,11 @@ recorded in task `07-26-small-team-internal-oa-review`.
 - Exercise task validate/current/list and run Trellis governance.
 - Archive the final active task and assert Trellis governance still passes with
   zero active task directories.
-- Confirm no `.new`, backup, bytecode or out-of-scope platform assets are
-  tracked; finish with `git diff --check`.
+- Record pre-existing backup directory names before update; confirm no `.new`,
+  newly generated backup, bytecode or out-of-scope platform assets are tracked
+  or left for the sensitive scanner. Do not interpret a historical backup as
+  evidence that the current upgrade backup may remain. Finish with
+  `git diff --check`.
 
 ### 7. Wrong vs Correct