feat: keep run artifacts under hidden .pygienium/ and out of git

All per-check artifacts, all-summary, and export move from pygienium/ to
.pygienium/; ensureRunStateIgnored appends .pygienium/ to the target
repo's .gitignore on first run (opt out with --no-gitignore), so a run
never stages its own output. Export now reads a single canonical root.

src/checks/dead-code.ts

@@ -950,14 +950,14 @@ export async function applyDeadCodeFixes(
 // Artifact paths
 // ---------------------------------------------------------------------------
 
-const CHECK_DIRNAME = "pygienium/checks/dead-code";
+const CHECK_DIRNAME = ".pygienium/checks/dead-code";
 
-/** `<target>/pygienium/checks/dead-code/findings.md` */
+/** `<target>/.pygienium/checks/dead-code/findings.md` */
 export function findingsPath(target: string): string {
 	return join(target, CHECK_DIRNAME, "findings.md");
 }
 
-/** `<target>/pygienium/checks/dead-code/changes.md` */
+/** `<target>/.pygienium/checks/dead-code/changes.md` */
 export function changesPath(target: string): string {
 	return join(target, CHECK_DIRNAME, "changes.md");
 }