phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/omnisearch/data.json

@@ -1,43 +0,0 @@
-{
-  "useCache": true,
-  "hideExcluded": false,
-  "recencyBoost": "0",
-  "downrankedFoldersFilters": [],
-  "ignoreDiacritics": true,
-  "ignoreArabicDiacritics": false,
-  "indexedFileTypes": [],
-  "indexFilesWithoutExtension": false,
-  "displayTitle": "",
-  "PDFIndexing": false,
-  "officeIndexing": false,
-  "imagesIndexing": false,
-  "aiImageIndexing": false,
-  "unsupportedFilesIndexing": "default",
-  "splitCamelCase": false,
-  "openInNewPane": false,
-  "vimLikeNavigationShortcut": false,
-  "ribbonIcon": true,
-  "showExcerpt": true,
-  "maxEmbeds": 5,
-  "renderLineReturnInExcerpts": true,
-  "showCreateButton": false,
-  "highlight": true,
-  "showPreviousQueryResults": true,
-  "simpleSearch": false,
-  "tokenizeUrls": false,
-  "fuzziness": "1",
-  "weightBasename": 10,
-  "weightDirectory": 7,
-  "weightH1": 6,
-  "weightH2": 5,
-  "weightH3": 4,
-  "weightUnmarkedTags": 2,
-  "weightCustomProperties": [],
-  "httpApiEnabled": false,
-  "httpApiPort": "51361",
-  "httpApiNotice": true,
-  "welcomeMessage": "1.21.0",
-  "verboseLogging": false,
-  "DANGER_httpHost": null,
-  "DANGER_forceSaveCache": false
-}

.obsidian/plugins/omnisearch/manifest.json

@@ -1,14 +0,0 @@
-{
-  "id": "omnisearch",
-  "name": "Omnisearch",
-  "version": "1.30.1",
-  "minAppVersion": "1.7.2",
-  "description": "A search engine that just works.",
-  "author": "Simon Cambier",
-  "authorUrl": "https://scambier.xyz",
-  "fundingUrl": {
-    "Github": "https://github.com/sponsors/scambier",
-    "Ko-fi": "https://ko-fi.com/scambier"
-  },
-  "isDesktopOnly": false
-}