phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/obsidian-advanced-uri/data.json

@@ -1,18 +0,0 @@
-{
-  "openFileOnWrite": true,
-  "openDailyInNewPane": true,
-  "openFileOnWriteInNewPane": true,
-  "openFileWithoutWriteInNewPane": false,
-  "idField": "id",
-  "useUID": false,
-  "addFilepathWhenUsingUID": false,
-  "allowEval": false,
-  "includeVaultName": true,
-  "vaultParam": "name",
-  "linkFormats": [
-    {
-      "name": "Markdown",
-      "format": "[{{name}}]({{uri}})"
-    }
-  ]
-}

.obsidian/plugins/obsidian-advanced-uri/manifest.json

@@ -1,11 +0,0 @@
-{
-    "id": "obsidian-advanced-uri",
-    "name": "Advanced URI",
-    "description": "Control various aspects through URIs, including opening files, creating new files, and executing commands.",
-    "isDesktopOnly": false,
-    "fundingUrl": "https://ko-fi.com/vinzent",
-    "version": "2.0.0",
-    "author": "Vinzent",
-    "authorUrl": "https://github.com/Vinzent03",
-    "minAppVersion": "1.5.7"
-}