chore(GRO-720): harden .gitignore against agent runtime leaks

Add defensive entries to prevent agent home artifacts, gh tokens,
and infra-repo checkouts from being accidentally committed.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitignore

@@ -8,3 +8,16 @@ dist/
 .turbo/
 coverage/
 minimax-output/
+
+# Agent runtime artifacts — never commit
+.gh-token
+*.gh-token
+.config/gh/
+**/.config/gh/
+infra-repo
+infra-repo/
+**/instructions/.gh-token
+**/AGENT_HOME/**
+$AGENT_HOME/**
+.claude/
+.codex/