phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/code-styler/manifest.json

@@ -1,11 +0,0 @@
-{
-	"id": "code-styler",
-	"name": "Code Styler",
-	"version": "1.1.7",
-	"minAppVersion": "0.15.0",
-	"description": "Style and customize codeblocks and inline code in both editing mode and reading mode.",
-	"author": "Mayuran Visakan",
-	"authorUrl": "https://github.com/mayurankv",
-	"fundingUrl": "https://www.buymeacoffee.com/mayurankv2",
-	"isDesktopOnly": false
-}