feat: keep run artifacts under hidden .pygienium/ and out of git

All per-check artifacts, all-summary, and export move from pygienium/ to
.pygienium/; ensureRunStateIgnored appends .pygienium/ to the target
repo's .gitignore on first run (opt out with --no-gitignore), so a run
never stages its own output. Export now reads a single canonical root.

README.md

@@ -126,9 +126,9 @@ registerCheck(def)            ← checks/*.ts self-register on load
         ├─ Q0 recon (shared, run once per run)   (src/recon.ts)
         │     git state + source-file inventory → .pygienium/recon.json
         ├─ analysis sub-agent  (buildScanTask)    ← scanner/<check> agent
-        │     writes pygienium/checks/<name>/findings.md
+        │     writes .pygienium/checks/<name>/findings.md
         ├─ fix sub-agent       (buildFixTask)     ← fixer, only with --fix
-        │     writes pygienium/checks/<name>/changes.md
+        │     writes .pygienium/checks/<name>/changes.md
         ├─ verify gate         (re-runs check.gate)
         └─ cleanup             (drops transient scratch artifacts)
 ```