chore: track the graphify knowledge graph and the bug-hunt ledger (#1381)

* chore: track the graphify knowledge graph and the bug-hunt ledger

Both were local-only, so a clone — including a cloud session, which sees
only tracked files — started with no graph and no findings history.

graphify-out/: the top-level built graph is now tracked so a fresh clone can
query it without a rebuild. Subdirectories stay ignored: cache/ is a
per-machine AST cache, and graphify parks the previous graph in a dated
YYYY-MM-DD/ backup on every rebuild (18 MB of stale duplicate, a local
rollback aid rather than shared state).

.gitattributes marks the tree -text: the repo-wide `* text=auto eol=lf` rule
would otherwise rewrite line endings inside .graphify_labels.json.sig, which
signs the labels byte-for-byte, and invalidate the signature on checkout.
graph.json/graph.html also get -diff, and the tree is linguist-generated so
it stays out of language stats and collapses in review.

.superpowers/: findings-ledger.json, its FINDINGS.md render and
render-ledger.mjs are tracked so contributors can add findings by PR. Hunt
transcripts, .bak snapshots and debris patches remain per-session scratch.

Tradeoff accepted deliberately: the post-commit rebuild hook rewrites
graph.json, so each refresh writes a fresh ~18 MB blob into history. Refresh
it in its own commit rather than folding it into an unrelated diff.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(graphify): refresh the graph over the newly-tracked files

The first commit added findings-ledger.json, FINDINGS.md and render-ledger.mjs
to the tracked tree, so the post-commit rebuild picked them up and rewrote the
graph. Also ignores .pending_changes, the transient rebuild-state file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(graphify): share the PreToolUse graph-first nudge hooks

The two hook-guard hooks lived in the gitignored settings.local.json with an
absolute C:/Users path, so no other clone got them. Portable form: bare
`graphify` off PATH, and `|| exit 0` so a contributor without graphify
installed is never blocked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Update graph output files and manifest

- Updated binary files: graph.html and graph.json with new content.
- Added new entry for findings-ledger.json in manifest.json with updated metadata.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -7,3 +7,15 @@
 *.ico binary
 *.wasm binary
 *.exe binary
+
+# Knowledge graph (graphify) — generated, committed so a fresh clone can query
+# it without rebuilding. `* text=auto eol=lf` above would rewrite line endings
+# inside these on checkout, and .graphify_labels.json.sig signs the labels
+# byte-for-byte, so normalization would invalidate the signature. -text opts the
+# whole tree out; -diff keeps a 17 MB graph out of textual diffs.
+graphify-out/** -text linguist-generated=true
+graphify-out/graph.json -diff
+graphify-out/graph.html -diff
+
+# Rendered from findings-ledger.json by render-ledger.mjs — never hand-edit.
+.superpowers/FINDINGS.md linguist-generated=true