build(layout): add repo-type marker convention and fail-closed CI guard

[NWarila]

Summary

Adds the module-layout sentinel and the independent CI guard that fails closed unless exactly one repo layout marker exists.

Changes

• Adds empty .github/.module as the module-layout marker.
• Allowlists .github/.script and .github/.module in the deny-all .gitignore.
• Removes .github/ export-ignore so the marker is included in source archives.
• Adds a standalone layout-marker CI job that validates exactly one marker.

Validation

• git check-ignore -v .github/.module
• git ls-files .github/.module
• git archive HEAD | tar -t | grep -F '.github/.module'
• Git Bash marker guard check returned marker count=1
• powershell -NoProfile -ExecutionPolicy Bypass -File C:\tmp\run-psscriptanalyzer.ps1
• powershell -NoProfile -ExecutionPolicy Bypass -File .\tests\Invoke-Tests.ps1 -MinimumCoverage 80
• git log origin/main..HEAD --name-only