phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI

- Remove 91 tracked-but-gitignored files from index (sessions, plugin
  data/manifests, pycache, memory-changes, obsidian state, credential
  notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
  13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
  that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
  patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
  KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.

.obsidian/plugins/table-editor-obsidian/data.json

@@ -1,6 +0,0 @@
-{
-  "formatType": "normal",
-  "showRibbonIcon": true,
-  "bindEnter": true,
-  "bindTab": true
-}

.obsidian/plugins/table-editor-obsidian/manifest.json

@@ -1,15 +0,0 @@
-{
-  "id": "table-editor-obsidian",
-  "name": "Advanced Tables",
-  "author": "Tony Grosinger",
-  "authorUrl": "https://grosinger.net",
-  "description": "Improved table navigation, formatting, manipulation, and formulas.",
-  "isDesktopOnly": false,
-  "minAppVersion": "1.0.0",
-  "version": "0.23.2",
-  "fundingUrl": {
-    "Github Sponsor": "https://github.com/sponsors/tgrosinger",
-    "Buy me a Coffee": "https://buymeacoffee.com/tgrosinger",
-    "Paypal": "https://paypal.me/tgrosinger"
-  }
-}