phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.gitignore

@@ -3,18 +3,11 @@
 # ============================================
 
 # --------------------------------------------
-# Sensitive Files
+# Sensitive Directories
 # --------------------------------------------
 04_Archive/SENSITIVE-DO-NOT-SYNC/
 04_Archive/security-sensitive/
 04_Archive/personal-private/
-**/*login*.md
-**/*password*.md
-**/*credential*.md
-**/*secret*.md
-**/*private*.md
-**/apikey*.md
-**/token*.md
 
 # --------------------------------------------
 # Obsidian Configuration
@@ -249,3 +242,28 @@ __pycache__/
 # Agent / tool temporary files
 # --------------------------------------------
 .memory-changes-*.txt
+
+# --------------------------------------------
+# QMD / Memory index
+# --------------------------------------------
+.qmd/
+.memory-index.lock
+*.sqlite-wal
+*.sqlite-shm
+
+# --------------------------------------------
+# Credential notes (keys live in service side, not in vault)
+# --------------------------------------------
+01_Projects/Personal-Tech/Development/Github.md
+03_Resources/Community/Matrix Server.md
+03_Resources/Development/AI-ML/Braintrust.dev.md
+03_Resources/Development/AI-ML/DeepSeek-config.md
+03_Resources/Development/AI-ML/Matrix Bot-config.md
+03_Resources/Development/AI-ML/OpenRouter-config.md
+03_Resources/Development/AI-ML/Opencode-config.md
+01_Projects/Infrastructure/Services/vaultwarden.md
+03_Resources/Development/DevOps/Gitlab/rest api.md
+01_Projects/Work/Government-Projects/Virtual-Data-Center/prod.md
+01_Projects/Work/Government-Projects/Municipal-Development-Reform/deploy.md
+01_Projects/Work/Government-Projects/Municipal-Development-Reform/production.md
+01_Projects/Work/Government-Projects/Industry-Info/Deployment.md