phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/obsidian-git/data.json

@@ -1,68 +0,0 @@
-{
-  "commitMessage": "vault backup: {{date}}",
-  "autoCommitMessage": "vault backup: {{date}}",
-  "commitMessageScript": "",
-  "commitDateFormat": "YYYY-MM-DD HH:mm:ss",
-  "autoSaveInterval": 0,
-  "autoPushInterval": 0,
-  "autoPullInterval": 0,
-  "autoPullOnBoot": true,
-  "autoCommitOnlyStaged": false,
-  "disablePush": false,
-  "pullBeforePush": true,
-  "disablePopups": false,
-  "showErrorNotices": true,
-  "disablePopupsForNoChanges": false,
-  "listChangedFilesInMessageBody": false,
-  "showStatusBar": true,
-  "updateSubmodules": false,
-  "syncMethod": "merge",
-  "mergeStrategy": "none",
-  "customMessageOnAutoBackup": false,
-  "autoBackupAfterFileChange": false,
-  "treeStructure": false,
-  "refreshSourceControl": true,
-  "basePath": "",
-  "differentIntervalCommitAndPush": false,
-  "changedFilesInStatusBar": false,
-  "showedMobileNotice": true,
-  "refreshSourceControlTimer": 7000,
-  "showBranchStatusBar": true,
-  "setLastSaveToLastCommit": false,
-  "submoduleRecurseCheckout": false,
-  "gitDir": "",
-  "showFileMenu": true,
-  "authorInHistoryView": "hide",
-  "dateInHistoryView": true,
-  "diffStyle": "split",
-  "hunks": {
-    "showSigns": false,
-    "hunkCommands": false,
-    "statusBar": "colored"
-  },
-  "lineAuthor": {
-    "show": false,
-    "followMovement": "inactive",
-    "authorDisplay": "initials",
-    "showCommitHash": false,
-    "dateTimeFormatOptions": "date",
-    "dateTimeFormatCustomString": "YYYY-MM-DD HH:mm",
-    "dateTimeTimezone": "viewer-local",
-    "coloringMaxAge": "1y",
-    "colorNew": {
-      "r": 255,
-      "g": 150,
-      "b": 150
-    },
-    "colorOld": {
-      "r": 120,
-      "g": 160,
-      "b": 255
-    },
-    "textColorCss": "var(--text-muted)",
-    "ignoreWhitespace": false,
-    "gutterSpacingFallbackLength": 5,
-    "lastShownAuthorDisplay": "initials",
-    "lastShownDateTimeFormatOptions": "date"
-  }
-}

.obsidian/plugins/obsidian-git/manifest.json

@@ -1,10 +0,0 @@
-{
-    "author": "Vinzent",
-    "authorUrl": "https://github.com/Vinzent03",
-    "id": "obsidian-git",
-    "name": "Git",
-    "description": "Integrate Git version control with automatic backup and other advanced features.",
-    "isDesktopOnly": false,
-    "fundingUrl": "https://ko-fi.com/vinzent",
-    "version": "2.39.0"
-}