chore: untrack gitnexus-generated agent files

[MichaelTaylor3d]

gitnexus analyze writes AGENTS.md, CLAUDE.md and .claude/skills/gitnexus/** into the repository it indexes. These are development-loop private tooling output, not product code, and carry no secrets. This PR untracks them and adds a .gitignore block so they stay untracked going forward. History is deliberately NOT rewritten.

Refs #3177

[MichaelTaylor3d]

Verdict: PASS

Re-gate at the final head (this repo's DELETE-group PR, follow-up commit applied):

• Follow-up commit chore: drop private-repo reference from gitignore comment is the sole new commit after the previously-reviewed head; base is still an ancestor (compare API: ahead, behind=0) — no rebase/force-push/amend.
• Follow-up diff touches exactly one file (.gitignore), one line changed.
• Final .gitignore: grep -c dig_ecosystem = 0, no #3177 reference remains.
• Rest of the gitnexus-ignore block intact: /AGENTS.md, /CLAUDE.md, /.claude/skills/gitnexus/, /.claude/skills/generated/, /.gitnexus/ all present (DELETE group keeps /CLAUDE.md in the block, matching that both AGENTS.md and CLAUDE.md were 100% generated here and deleted whole).
• Cumulative diff vs base: 9 files, matches the table; nothing extraneous.

Known structural constraint: gh pr review --approve fails here ("Can not approve your own pull request" — same identity authored the PR). Posting as `--comment" with the verdict stated explicitly per DIG-Network/dig_ecosystem#3177 review protocol.

[MichaelTaylor3d]

Security re-gate — PASS

Verified at final head:

1. Exactly one follow-up commit (chore: drop private-repo reference from gitignore comment), the prior commit is still its parent (no amend/rebase/force-push); git log shows single-parent linear history throughout.
2. Follow-up touches .gitignore only, one-line diff (no CRLF/whole-file churn).
3. .gitignore at final head: 0 hits for dig_ecosystem, 0 hits for #3177 (message and file).
4. Ignore block intact: /AGENTS.md, /CLAUDE.md, /.claude/skills/gitnexus/, /.claude/skills/generated/, /.gitnexus/ all present.
5. Cumulative diff base->head: only the 9 expected files (gitignore + AGENTS.md + CLAUDE.md + 6 gitnexus SKILL.md files). No source/test/CI/lockfile/manifest hunks. Branch is a fast-forward descendant of base (compare API: status=ahead, behind_by=0).
6. Identity: every commit author/committer = michael@michaeltaylor.dev (machine-inherited), no constructed identity.
7. Content swept for credential patterns, key material, absolute local paths, emails, hostnames/IPs, private-repo references — none found beyond the doc placeholders --api-key (CLI flag name) and OPENAI_API_KEY (env-var name) inside gitnexus's own SKILL.md docs.

Verdict on the removed content: PRIVATE-BUT-HARMLESS. No live vulnerability found.