chore(repo): untrack internal notes, add hygiene gate and tracked-only deploy policy

The public repo (and, via the old working-tree upload_folder deploy, the public
HF Space) carried internal working notes: root CX/KM audits and the session
handoff docs/NEXT_SESSION.md. Untrack them (local copies stay), ignore the
whole class in .gitignore, and add scripts/check_repo_hygiene.py (--self-test)
to CI so they cannot silently return. The Space itself was pruned of the leaked
notes plus stale artifacts (pre-redesign .otf fonts, data_flow.html/pdf, orphan
eval reports) in Space commit 8a247fa1; the local .deploy_hf.py now publishes
git-tracked files only and prunes strays on every deploy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JuliaEdom

.github/workflows/ci.yml

@@ -38,3 +38,15 @@ jobs:
 
       - name: Pytest
         run: uv run pytest --cov=src/nl_sql --cov-report=term-missing
+
+  repo-hygiene:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify repo-hygiene detector
+        run: python3 scripts/check_repo_hygiene.py --self-test
+
+      - name: Check no internal notes are tracked
+        run: python3 scripts/check_repo_hygiene.py

.gitignore

@@ -109,6 +109,16 @@ chroma_data.*/
 # Reviews scratch (полные обзоры коммитятся, runtime артефакты — нет)
 reviews/*.err
 
+# Внутренняя кухня — аудиты, планы, handoff-заметки. Никогда не публикуется:
+# ни в git-индексе, ни на HF Space (деплой фильтрует по git ls-files).
+# Гейт: scripts/check_repo_hygiene.py (CI) + прунинг в .deploy_hf.py.
+/audit_*.md
+/plan_*.md
+/_ref_*
+/[0-9][0-9]_[0-9][0-9]_[0-9][0-9].md
+/docs/NEXT_SESSION.md
+/docs/data_flow.*
+
 # Secrets — никогда не коммитить
 secrets/
 credentials/