phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/obsidian-icon-folder/data.json

@@ -1,31 +0,0 @@
-{
-  "settings": {
-    "migrated": 6,
-    "iconPacksPath": ".obsidian/icons",
-    "fontSize": 16,
-    "emojiStyle": "twemoji",
-    "iconColor": null,
-    "recentlyUsedIcons": [],
-    "recentlyUsedIconsSize": 5,
-    "rules": [],
-    "extraMargin": {
-      "top": 0,
-      "right": 4,
-      "bottom": 0,
-      "left": 0
-    },
-    "iconInTabsEnabled": true,
-    "iconInTitleEnabled": true,
-    "iconInTitlePosition": "above",
-    "iconInFrontmatterEnabled": true,
-    "iconInFrontmatterFieldName": "icon",
-    "iconColorInFrontmatterFieldName": "iconColor",
-    "iconsBackgroundCheckEnabled": true,
-    "iconsInNotesEnabled": true,
-    "iconsInLinksEnabled": true,
-    "iconIdentifier": ":",
-    "lucideIconPackType": "native",
-    "debugMode": false,
-    "useInternalPlugins": false
-  }
-}

.obsidian/plugins/obsidian-icon-folder/manifest.json

@@ -1,10 +0,0 @@
-{
-  "id": "obsidian-icon-folder",
-  "name": "Iconize",
-  "version": "2.14.7",
-  "minAppVersion": "0.9.12",
-  "description": "Add icons to anything you desire in Obsidian, including files, folders, and text.",
-  "author": "Florian Woelki",
-  "authorUrl": "https://florianwoelki.com/",
-  "isDesktopOnly": false
-}