feat: add org-default .gitignore baseline

[JacobPEvans-personal]

Summary

Adds configs/gitignore — an org-default .gitignore baseline — as a new shared
inheritance surface, consumed the same copy-at-scaffold way as the other
dryvist/.github configs. Consolidates common ignore patterns (environment files,
credential/secret material, cloud-provider state, Terraform/OpenTofu state, and
AI-assistant local artifacts) into one canonical source so repos don't each
hand-roll inconsistent coverage.

README updated (inheritance table, API table, usage snippet).

Carve-outs deliberately preserved

• .envrc stays committed (direnv convention).
• *.sops.yaml/.yml ciphertext stays committed.
• .terraform.lock.hcl stays committed.
• Committed AI config (.claude/settings.json, .claude/rules/, CLAUDE.md,
  AGENTS.md) is intentionally not ignored.

Rollout

Establishes the source of truth; does not retro-apply. Repos adopt by appending
configs/gitignore and de-duping.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces an organization-default .gitignore baseline (configs/gitignore) to prevent committing secrets, credentials, and AI-assistant local state, and updates the README.md with instructions on how to append it during repository scaffolding. The review feedback suggests narrowing down the overly broad *credentials* wildcard pattern to avoid ignoring valid source files, and adding an explicit newline before appending to .gitignore in the scaffolding command to prevent formatting issues.