feat: keep run artifacts under hidden .pygienium/ and out of git

All per-check artifacts, all-summary, and export move from pygienium/ to
.pygienium/; ensureRunStateIgnored appends .pygienium/ to the target
repo's .gitignore on first run (opt out with --no-gitignore), so a run
never stages its own output. Export now reads a single canonical root.

src/checks/deep-modules.ts

@@ -11,7 +11,7 @@
  *
  * Lifecycle:
  *   gate (need source files) → recon (shared) → scan sub-agent writes
- *   `<cwd>/pygienium/checks/deep-modules/findings.md` → [with --fix] fix
+ *   `<cwd>/.pygienium/checks/deep-modules/findings.md` → [with --fix] fix
  *   sub-agent writes `changes.md`, inlines safe pass-throughs, and lists
  *   risky consolidations (external importers / public API) for human review.
  *
@@ -32,7 +32,7 @@ import { isScopeSource, scopeRulesMarkdown } from "./scope.js";
 
 /** Output directory for this check's persistent reports. */
 export function deepModulesOutputDir(cwd: string): string {
-	return join(cwd, "pygienium", "checks", "deep-modules");
+	return join(cwd, ".pygienium", "checks", "deep-modules");
 }
 
 /** `findings.md` path for this check. */