fix(gitignore): keep helper locks, temps and backups out of --vault

[matiasmacera]

What

.gitignore (framework section, above the operator marker) now ignores the runtime files AIOS's own helpers write inside the vault tree:

Helper	File it leaves next to the note
aios-note-append	<note>.aios-lock/ (mutex with a pid file) · <note>.aiostmp (atomic write)
aios-snapshot	.aios-snapshot.lock/ · .aios-snapshot.<pid>.tmp (in the snapshot dir)
route-insight.py	<file>.routebak-<timestamp> (pre-write backup, kept on success)
reclaim mutex beside a lock	<lock>.reclaim/ (proposed in #187; harmless if that does not land)
vendored superpowers skills	.superpowers/ (their own docs ask for it to be ignored)

Why

aios-commit --vault adds untracked files with ls-files --others --exclude-standard, so .gitignore is its only filter. None of these files were excluded. A --vault commit made while a helper held its lock, or after route-insight.py kept a backup, carried them next to the real change. Observed on a live vault: a close-of-day commit carried two route-insight backups of an observed file.

The fix lives in .gitignore rather than in the sweep's exclusion list, so it also covers plain git status and git add.

Proof

New suite tests/gitignore-helper-artifacts.test.sh, registered in primitives and in the bash 3.2 lane:

1. Drift guard. Each artifact name is grepped from the helper that writes it, so renaming one in a hook fails the suite instead of leaving a rule that matches nothing.
2. Control. In a scratch repo with no .gitignore, a real aios-commit --vault --no-push commits all 8 in-vault artifacts.
3. Fix. With this .gitignore, the same commit carries the 4 notes and snapshots (day note, observed file, two same-day snapshots) and none of the 8 artifacts. Paths include folders with spaces.
4. The .superpowers/ rule also holds at the repo root and does not swallow skills/superpowers/.

Run	Result
bash 3.2.57 (/bin/bash)	21 passed, 0 failed
bash 5.3	21 passed, 0 failed
same suite against the current main .gitignore	12 passed, 9 failed (every artifact committed)
tests/changelog-entry-shape.test.sh	17 passed, 0 failed
full tests/*.test.sh battery	88 of 88 suites passed (one nested claude -p check in headless-allowlist hung locally and was skipped)

The changelog's cleanup command, git ls-files -ci --exclude-standard, was checked on git 2.24: against six tracked artifacts and four notes, including three with lookalike names such as aios-snapshot.lock.md and guide.aiostmp.md, it listed exactly the six artifacts.

Not in this PR

route-insight.py names its backup from the file's mtime at one-second precision, so two routings of the same file within one second would overwrite the first backup. That predates this change and is separate from whether the backup reaches git.

🤖 Generated with Claude Code

[chuycepeda]

Thank you, Matías. This shipped in v0.8.6 (merged via #195). The control run without a .gitignore is what made this test worth having. We also checked the operator-section merge in /aios:update against a real vault: your new rules land above the marker, and operators' own rules below it are untouched.