phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/better-word-count/data.json

@@ -1,35 +0,0 @@
-{
-  "statusBar": [
-    {
-      "prefix": "",
-      "suffix": " words",
-      "metric": {
-        "type": 0,
-        "counter": 0
-      }
-    },
-    {
-      "prefix": " ",
-      "suffix": " characters",
-      "metric": {
-        "type": 0,
-        "counter": 1
-      }
-    }
-  ],
-  "altBar": [
-    {
-      "prefix": "",
-      "suffix": " files",
-      "metric": {
-        "type": 2,
-        "counter": 6
-      }
-    }
-  ],
-  "countComments": true,
-  "collectStats": true,
-  "displaySectionCounts": true,
-  "pageWords": 300,
-  "statsPath": ".obsidian/vault-stats.json"
-}

.obsidian/plugins/better-word-count/manifest.json

@@ -1,9 +0,0 @@
-{
-  "id": "better-word-count",
-  "name": "Better Word Count",
-  "version": "0.10.1",
-  "description": "Counts the words of selected text in the editor.",
-  "author": "Luke Leppan",
-  "authorUrl": "https://lukeleppan.com",
-  "isDesktopOnly": false
-}