fix(discover): skip .worktrees directory during indexing - #37

Git worktrees (stored in .worktrees/) duplicate the entire source tree,
causing the knowledge graph to contain duplicate nodes and edges for
every function, class, and route. Add .worktrees to IGNORE_PATTERNS
alongside .git and .svn.

Incorporates the fix from PR #37 by @wassertim. Closes #31 (partial).

Co-authored-by: wassertim <[email protected]>

Git worktrees (stored in .worktrees/) duplicate the entire source tree,
causing the knowledge graph to contain duplicate nodes and edges for
every function, class, and route. Add .worktrees to IGNORE_PATTERNS
alongside .git and .svn.

Incorporates the fix from PR DeusData#37 by @wassertim. Closes DeusData#31 (partial).

Co-authored-by: wassertim <[email protected]>

The codeql-gate job failed every run on 32 open alerts. Only one was a
CodeQL finding in this repository's own code; the rest were CodeQL
findings in vendored third-party grammars and OpenSSF Scorecard
repository-hygiene checks.

Gate (.github/workflows/_security.yml):
- Count only CodeQL alerts outside vendored/ and internal/cbm/vendored/.
  Scorecard keeps reporting in its own workflow; vendored grammar code is
  upstream code this repo does not patch.
- On pull requests, query the PR's own analysis
  (ref=refs/pull/N/merge). Without a ref the API answers for the default
  branch, so a fix inside a PR could never clear the gate before merging.
- Paginate (per_page=100, --paginate). The unpaginated call returned at
  most 30 alerts, so the count silently capped at 30.
- Fail-closed behavior is unchanged: an unreadable alert list or a
  non-numeric count still blocks. tests/test_security_gate_fail_closed.sh
  passes.

Findings fixed:
- src/simhash/minhash.c (CodeQL cpp/overflowing-snprintf, alert #13):
  cbm_minhash_to_hex advanced its offset by snprintf's return value
  without checking it. Stop and terminate on a negative or truncated
  write.
- .github/workflows/claude.yml, claude-code-review.yml (Scorecard
  TokenPermissions DeusData#36, DeusData#37): add a deny-all top-level `permissions: {}`;
  each job already grants what it needs.

Diagnostics:
- .github/workflows/_test.yml: upload build/c/test-logs/*.log from a
  failed Windows test shard. The harness prints only the last 15 lines of
  each failing suite, which cut off the ASan report for index_resilience
  on Windows.

Validation: security-audit.sh and the gate fail-closed contract pass;
make lint-ci lint-tidy-diff passes; scripts/test.sh --suites simhash 25
passed. The new filter evaluated against the live alert API counts only
alert #13 on the default branch and 0 for refs/pull/12/merge.

Co-Authored-By: Claude Opus 5.5 <[email protected]>