feat(foundation): adopt the pinned universal gitignore baseline

[szmyty]

Filament currently has architecture documents but no ignore file. This PR adopts the accepted Empathy universal baseline as the first manual consumer pilot for the file-contract master epic.

Closes #5.

The root .gitignore contains the accepted 27 rules. The selection declares only the universal root scope, with no engine overlays or local additions: Filament has not selected or implemented its IaC toolchain.

The supporting manifest and generated plan make that selection reproducible. The adoption record, linked from README, captures provenance, verification commands, update/rollback behavior, ownership, and the one-PR-at-a-time review process. It reuses Empathy's pinned Git harness without adding a local validator framework.

Source and evidence

• Foundation 1.1.0, pinned to accepted Empathy commit b44f798bb49259f9f48416b4ffebde1103e135c0 (PR #90).
• Baseline SHA-256: 79280ac4f3147ead97a0b21b01f40241238f08fa5d63abe3f81c8b64e7f179f0.
• Active file SHA-256: 3637ea33004215037e745cf898f59e7c2a3195f8b66df5bae0921186ec731373.
• Pinned manifest validation and plan drift check pass; independent plan regeneration is byte-identical; active file matches the plan exactly.
• Both documented verification blocks were executed. 14 tests pass: 12 upstream behavior tests against Filament's actual file, plus repository-path and candidate-IaC-source visibility checks. All 23 candidate tracked paths remain visible.
• Tests cover local/private state, environment-template suffixes, shared configuration, lockfiles, reviewed artifacts, excluded-parent negation, nested overrides, and tracked-file limits. Git 2.51.1 / Python 3.12.14.
• Prettier 3.8.1, Markdownlint 0.48.0, local links, and staged diff checks pass. Generated plan serialization is preserved.
• The clean pilot checkout had zero ignored/untracked paths before adoption and zero ignored untracked paths afterward. No private payloads were read or staged.

Review boundaries

This is a manually verified .gitignore pilot. Filament has no configured CI workflow at the inspected base; the PR head reports no Actions runs or commit statuses at handoff. These are local results, not a CI pass. Shared EgoLint/Relay enforcement, Holon materialization, and Pace fleet adoption remain pending; direct MegaLinter repair stays deferred per the maintainer's direction.

The manifest's required license_expression field is NOASSERTION because Filament has no selected license. It grants no license and makes no claim that the rest of the foundation catalog is implemented. Engine-specific state/plan/variable exclusions must accompany the eventual IaC implementation.

ADR not required: this consumes the accepted baseline and preserves Filament's architecture and undecided engine/provider boundary. It supports repository-foundation work without completing the existing identity/license gate or advancing roadmap status.

Roadmap-Step: FIL-Q02

Tested head: 92eaffb9bcec6c278dccc522680fedabf7372010; local and remote tree: 4dd6c6b8d3d71dc0338806a399305168c56a518e.

Ready for maintainer review and merge. After merge, verify live state and checkpoint pilot acceptance in the master epic before starting the next authorized part.