chore(GRO-720): harden .gitignore against agent runtime leaks

Add defensive entries to block staging of agent home directories,
GH tokens, and infra-repo checkouts. These patterns were confirmed
exfiltrated in commit a407f866 on the now-deleted branch.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitignore

@@ -8,3 +8,16 @@ dist/
 .turbo/
 coverage/
 minimax-output/
+
+# Agent runtime artifacts — never commit
+.gh-token
+*.gh-token
+.config/gh/
+**/.config/gh/
+infra-repo/
+infra-repo
+**/instructions/.gh-token
+**/AGENT_HOME/**
+$AGENT_HOME/**
+.claude/
+.codex/