sink: strip leading dots per path segment in slug() (backup-gate coverage fix)

An env credential's Identity (".env / API_TOKEN") produced StorePath
imported/env/.env/api_token; gopass hides dot-prefixed segments from
`ls --flat`, so those entries were invisible to bundle.ListPaths and the
mandatory backup gate silently under-covered them (Hard Rule #1 violation).
slug() now strips leading dots per /-separated segment so incredigo can no
longer write a path that `ls --flat` hides. Locked in by
TestStorePathNoDotSegment.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/sink/bundle_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"incredigo/internal/discover"
@@ -106,3 +107,31 @@ func TestStorePathNoDoubleSegment(t *testing.T) {
 		t.Errorf("StorePath = %q, want imported/file/keys/deploy", got)
 	}
 }
+
+// TestStorePathNoDotSegment guards Hard Rule #1: a dot-prefixed path segment
+// (e.g. ".env") is hidden by gopass `ls --flat`, which would make the entry
+// invisible to the backup gate's coverage check. slug() must strip leading
+// dots so every stored credential is enumerable and therefore backed up.
+func TestStorePathNoDotSegment(t *testing.T) {
+	gp := &Gopass{Prefix: "imported/"}
+	cases := []struct {
+		identity string
+		want     string
+	}{
+		{".env / API_TOKEN", "imported/env/env/api_token"},
+		{".env.prod / DATABASE_URL", "imported/env/env.prod/database_url"},
+		{".netrc / password", "imported/env/netrc/password"},
+	}
+	for _, tc := range cases {
+		c := discover.Credential{Source: "env", Identity: tc.identity}
+		got := gp.StorePath(c)
+		if got != tc.want {
+			t.Errorf("StorePath(%q) = %q, want %q", tc.identity, got, tc.want)
+		}
+		for _, seg := range strings.Split(got, "/") {
+			if strings.HasPrefix(seg, ".") {
+				t.Errorf("StorePath(%q) = %q has hidden dot-segment %q", tc.identity, got, seg)
+			}
+		}
+	}
+}