phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/dataview/data.json

@@ -1,27 +0,0 @@
-{
-  "renderNullAs": "\\-",
-  "taskCompletionTracking": true,
-  "taskCompletionUseEmojiShorthand": true,
-  "taskCompletionText": "completion",
-  "taskCompletionDateFormat": "yyyy-MM-dd",
-  "recursiveSubTaskCompletion": true,
-  "warnOnEmptyResult": true,
-  "refreshEnabled": true,
-  "refreshInterval": 2500,
-  "defaultDateFormat": "MMMM dd, yyyy",
-  "defaultDateTimeFormat": "h:mm a - MMMM dd, yyyy",
-  "maxRecursiveRenderDepth": 4,
-  "tableIdColumnName": "File",
-  "tableGroupColumnName": "Group",
-  "showResultCount": true,
-  "allowHtml": true,
-  "inlineQueryPrefix": "=",
-  "inlineJsQueryPrefix": "$=",
-  "inlineQueriesInCodeblocks": true,
-  "enableInlineDataview": true,
-  "enableDataviewJs": true,
-  "enableInlineDataviewJs": true,
-  "prettyRenderInlineFields": true,
-  "prettyRenderInlineFieldsInLivePreview": true,
-  "dataviewJsKeyword": "dataviewjs"
-}

.obsidian/plugins/dataview/manifest.json

@@ -1,11 +0,0 @@
-{
-  "id": "dataview",
-  "name": "Dataview",
-  "version": "0.5.68",
-  "minAppVersion": "0.13.11",
-  "description": "Complex data views for the data-obsessed.",
-  "author": "Michael Brenan <blacksmithgu@gmail.com>",
-  "authorUrl": "https://github.com/blacksmithgu",
-  "helpUrl": "https://blacksmithgu.github.io/obsidian-dataview/",
-  "isDesktopOnly": false
-}