a172d76f2d
`backups/` is where the pre-update snapshot the updater restores a swept state.db FROM lives — leaving it unignored means the recovery copy is swept together with the live database. `vault.key`/`vault.json.enc` are the local secret vault. Docs: website/docs/getting-started/updating.md explains that on a flat install (checkout root == $HERMES_HOME) runtime state is git-ignored and never enters the autostash.