feat: keep run artifacts under hidden .pygienium/ and out of git

All per-check artifacts, all-summary, and export move from pygienium/ to
.pygienium/; ensureRunStateIgnored appends .pygienium/ to the target
repo's .gitignore on first run (opt out with --no-gitignore), so a run
never stages its own output. Export now reads a single canonical root.

src/modes/check-runner.ts

@@ -82,12 +82,14 @@ export interface RunCheckOptions {
 	hasUI?: boolean;
 	/** Pre-existing run state to update (for `/pygienium-all` and resume). */
 	existingState?: RunState;
+	gitignore?: boolean;
 }
 
 /** Outcome of a single check run. */
 export interface CheckRunOutcome {
 	/** Final check status. */
 	status: "complete" | "failed" | "skipped";
+	gitignoreAppended?: boolean;
 	/** Findings text from the analysis phase. */
 	findings?: string;
 	/** Changes text from the fix phase (when run with --fix). */