CLI: make credentials.yaml safer

[josephjclark]

we don't want users to accidentally check in credentials.yaml with real credentials

It is designed

How do we best guard for this?

• if in a git repo, auto add it to gitignore
• don't generate it by default (prompt to generate at runtime maybe?)

[josephjclark]

The most important thing actually is that GH sync does not auto create credentials.yaml!