feat: keep run artifacts under hidden .pygienium/ and out of git

All per-check artifacts, all-summary, and export move from pygienium/ to
.pygienium/; ensureRunStateIgnored appends .pygienium/ to the target
repo's .gitignore on first run (opt out with --no-gitignore), so a run
never stages its own output. Export now reads a single canonical root.

src/checks/defensive-guards.ts

@@ -30,7 +30,7 @@
  *
  * Lifecycle:
  *   gate (need source files) → recon (shared) → scan sub-agent writes
- *   `<cwd>/pygienium/checks/defensive-guards/findings.md` separating redundant
+ *   `<cwd>/.pygienium/checks/defensive-guards/findings.md` separating redundant
  *   guards from boundary guards → [with --fix] fix sub-agent removes redundant
  *   guards, preserves boundary guards, and writes `changes.md` distinguishing
  *   removed vs kept-with-reason.
@@ -52,7 +52,7 @@ import { isScopeSource, scopeRulesMarkdown } from "./scope.js";
 
 /** Output directory for this check's persistent reports. */
 export function defensiveGuardsOutputDir(cwd: string): string {
-	return join(cwd, "pygienium", "checks", "defensive-guards");
+	return join(cwd, ".pygienium", "checks", "defensive-guards");
 }
 
 /** `findings.md` path for this check. */