feat(foundation): 🧱 define scoped gitignore composition

[szmyty]

Why

The accepted universal ignore source has no catalog identity or deterministic way to combine project rules and repository-owned additions. This is part 2 of #82: define and prove composition before reviewing the live-root migration.

Changes

• Advance the foundation catalog/manifest contract to 1.1.0; register the universal source and rust-build overlay with SHA-256 digests on the existing required, repository-owned gitignore artifact.
• Require explicit project scopes and overlay selection. A Rust profile alone installs no ignore rules; the selected workspace/project gets an anchored /target/.
• Compose selected overlays, verbatim local text, then the universal baseline in every declared scope. Preserve local comments/order and prove a reviewed output exception while adjacent generated output stays ignored.
• Add read-only source validation and plan-gitignore / check-gitignore-plan. Plans identify their generator, owners, input hashes, proposed content, and output hashes; they are not adoption evidence.
• Regenerate the golden plan, inventory, and EgoLint presence/ownership projection. The latter pins the real source commit ee93d0bbf7e51aeb856eb0ae40c44d0f3e2edaa1; source and projection are separate commits to avoid a circular commit reference.
• Capture versioning, preservation, updates, rollback, validation, and the next review checkpoint. Expand automation path coverage to catalog, manifest, schemas, and composer code.

Validation

• Full repository suite: 110 tests run, 108 passed, two expected Identity skips.
• Ignore suites: 28 tests passed, including six tests of composed content against real Git and ten composition/source/CLI contract tests.
• Ruff 0.16.5 check and format check pass with CI's egolint/.config/lint/python/ruff.toml.
• JSON Schema Draft 2020-12 schemas and catalog/manifest instances validate.
• Generated plan, inventory, EgoLint projection, and existing golden workspace checks pass; the pinned catalog/manifest/fragments/composer equal the source commit.
• Markdownlint and Prettier pass for the edited authoring surfaces. The existing iteration list was aligned with both tools.
• The active root .gitignore is byte-identical to the base. No consumer repository was changed.
• Unchanged-base comparison: repository suite was 94 tests with the same two skips; the separate EgoLint suite was 31 tests with its existing test_catalog_is_pinned_to_the_workflow_release failure.

Completed GitHub CI for 8b398b3bff54fb95f181dac20af6342ec3ed4cc4:

• MegaLinter passed, including Ruff, Markdownlint, JSON/YAML format checks, and secret scanning. Its log still contains the pre-existing pre-command shell || syntax diagnostic; the enabled linters completed successfully.
• Validate automation: workflow/action validation passed; all 110 repository tests passed with two expected skips. The following EgoLint suite fails only the same test_catalog_is_pinned_to_the_workflow_release mismatch reproduced on the unchanged base (31 tests, one failure).
• OSV remains red at the existing severity gate: 84 findings at or above high severity. This PR changes no dependency manifests or lockfiles.
• CodeQL, dependency review, commit validation, and lint architecture passed.

All seven triggered workflows completed. Repository-wide CI remains red for the documented existing pin mismatch and vulnerability gate; this PR does not claim to resolve them.

Review and continuation

Review explicit scope selection, baseline-last precedence, verbatim local additions, and source integrity. Unmanaged deeper ignore files can still override ancestor rules; EgoLint content conformance and Holon filesystem merging remain with their owners.

After this PR is reviewed and merged, the next bounded part reconciles the remaining audit dispositions and private-material protections, then migrates Empathy's active root. Filament follows the accepted upstream contract. Keep #82 open.

Refs #82
Parent: egohygiene/.github#32
Roadmap-Step: EMP-Q04 (partial contribution; no completion/status change)

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress