fix(gitignore): un-ignore shared .claude/{tasks,memory,audits}/

Previous rule (.claude/) ignored everything under .claude/, making
the new governance files invisible to git. Switches to a wildcard
pattern with explicit negations: tasks/memory/audits/settings.json
become trackable; settings.local.json and agent-memory/ stay
per-machine. Commits existing .claude/settings.json which now falls
under the tracked scope.

Verified with git check-ignore:
- .claude/memory/decisions.md → exit 1 (not ignored) ✓
- .claude/tasks/TODO.md      → exit 1 (not ignored) ✓
- .claude/settings.local.json → exit 0 (ignored)    ✓
- .claude/agent-memory/      → exit 0 (ignored)     ✓

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Glob|Grep",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "[ -f graphify-out/graph.json ] && echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"additionalContext\":\"graphify: Knowledge graph exists. Read graphify-out/GRAPH_REPORT.md for god nodes and community structure before searching raw files.\"}}' || true"
+          }
+        ]
+      }
+    ]
+  }
+}

.gitignore

@@ -57,7 +57,15 @@ skills/find-skills
 skills-disabled/
 
 # Local project config (per-machine, not shared)
-.claude/
+.claude/*
+!.claude/tasks/
+!.claude/memory/
+!.claude/audits/
+!.claude/settings.json
+# But keep local stuff ignored within .claude/
+.claude/settings.local.json
+.claude/agent-memory/
+.claude/gstack/
 
 # Generated outputs
 graphify-out/