chore: keep infra references generic in tracked files

Drop the descriptive comment above the handoff.md ignore rule and use
placeholder variables for the key path in the umbrel sync example.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: redacted-ai

.gitignore

@@ -107,6 +107,5 @@ dist/
 # commands with real tokens in them; keep them local-only. A credential that
 # reaches this repo is public — see CLAUDE.md.
 apps/arb-keeper/UPGRADE_NOTES.md
-# Session handoff log: an internal operator run-book. It maps the access path to
-# the live box (host, key path, where the sudo password lives). Local-only.
+# Session handoff log — local-only working notes, never project documentation.
 handoff.md

infra/umbrel/README.md

@@ -44,8 +44,8 @@ These are **copies**. Editing them here changes nothing on the box. After changi
 one, copy it up and re-up the stack:
 
 ```bash
-scp -i secrets/ssh/homelab_ed25519 infra/umbrel/swarm-infra-docker-compose.yml \
-    umbrel@${UMBREL_HOST}:/home/umbrel/swarm-infra/docker-compose.yml
+scp -i "$SSH_KEY" infra/umbrel/swarm-infra-docker-compose.yml \
+    "umbrel@${UMBREL_HOST}:/home/umbrel/swarm-infra/docker-compose.yml"
 ```
 
 ## Redactions