New repos can already contain .codex as a file. The bootstrap path previously surfaced a raw ENOTDIR and did not write the managed .gitignore until later in setup/doctor.

The installer now checks parent path segments, reports the blocking file with the target path, and writes the managed ignore block before scaffold/template work so Guardex-owned files are ignored even on early failure.

Constraint: Some repos already reserve .codex as a file
Rejected: Ignore the whole scripts/ directory | would hide user-owned automation in new repos
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep managed .gitignore initialization ahead of scaffold/template writes
Tested: node --test --test-name-pattern "setup and doctor explain \.codex file conflicts and still write managed gitignore first" test/install.test.js
Tested: node bin/multiagent-safety.js doctor --target /home/deadpool/Documents/machine-monitoring-system-esp-firmware
Tested: openspec validate agent-codex-handle-codex-file-path-and-early-gitigno-2026-04-21-10-35 --type change --strict
Tested: openspec validate --specs
Not-tested: full install test suite