Update ConfigKit and prepare Narratio v2.1.2

docs/config.md

@@ -240,8 +240,10 @@ inputs:
   and a missing or empty explicit selection is an error.
 - Each immediate regular file whose name is a valid environment-variable name
   supplies one value. ConfigKit removes trailing CR/LF, permits a symlink as the
-  selected directory, rejects symlink entries, and limits input to 1 MiB per
-  file, 8 MiB total, and 1024 entries.
+  selected directory, rejects non-hidden symlink entries, and limits input to
+  1 MiB per file, 8 MiB total, and 1024 entries. Dot-prefixed entries (including
+  files, directories, and symlinks) are ignored and omitted from bootstrap
+  reports, but still count toward the directory entry limit.
 - An existing process environment value takes precedence over a credential file.
 - On POSIX, operators must provision the directory with no group/other access
   (normally `0700`) and files with no group/other access (normally `0600`);

docs/releases/v2.1.2.md

@@ -0,0 +1,26 @@
+# Narratio v2.1.2
+
+This release allows secrets directories to contain hidden metadata without
+preventing credential loading.
+
+## Summary
+
+ConfigKit v0.3.1 ignores dot-prefixed entries such as `.git`, `.gitignore`, and
+`.DS_Store` during secrets bootstrap. These entries no longer block otherwise
+valid credentials from loading and are omitted from bootstrap reports.
+
+## Compatibility
+
+This is a backward-compatible dependency bug fix. Configuration schemas,
+existing-environment precedence, and validation of non-hidden entries are
+unchanged. Hidden entries still count toward the directory entry limit.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required. See the
+[credential configuration reference](../config.md) for secrets-directory usage.
+
+## Changes
+
+- Updated ConfigKit from v0.3.0 to v0.3.1.
+- Clarified hidden-entry handling in the secrets-directory documentation.