feat(GRO-2516): add agent-runtime credential stanza to .gitignore

Appends canonical ignore rules for .gh-token, .config/gh/,
.claude/, .codex/, and AGENT_HOME patterns per GRO-2516 guardrail
to prevent accidental commit of agent credential artifacts.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitignore

@@ -5,4 +5,14 @@ node_modules/
 dist/
 playwright-report/
 test-results/
-*.log
+*.log
+# Agent runtime artifacts — never commit
+.gh-token
+*.gh-token
+**/.gh-token
+.config/gh/
+**/.config/gh/
+**/AGENT_HOME/**
+$AGENT_HOME/**
+.claude/
+.codex/