chore(repo): gitignore root .ai/ orchestrator-workflow run state

[LanNguyenSi]

Closes the preflight deadlock caused by untracked orchestrator-workflow run state.

Problem

Untracked run directories under .ai/runs/ (00-goal.md through 06-handoff.md per run) make the worktree dirty. harness preflight then fails its clean-worktree check, leaves the preflight tag unwritten, and the investigation gate deadlocks. Observed on the MacBook during the toolchain-parity rollout on 2026-07-23; the run files had to be parked on a local-only branch just to get a clean tree.

Run state is orchestration bookkeeping and does not belong in commits or PRs (operator rule, 2026-06-19).

Why the pattern is root-anchored

The rule is /.ai/, not .ai/. An unanchored pattern matches at every directory level and would also swallow packages/agent-memory-sync/.ai/ and packages/memory-digest-cli/.ai/, which hold 8 tracked per-package agent docs (AGENTS.md, ARCHITECTURE.md, DECISIONS.md, TASKS.md). Those files stay tracked either way, but an unanchored rule hides them from every gitignore-aware search tool and makes git add -A silently skip new files there, while both packages' docs/ways-of-working.md tell agents to read .ai/AGENTS.md first.

This was caught in review; the first revision of this branch had the unanchored form.

Scope

Nothing under the repo-root .ai/ is tracked, so the ignore takes effect immediately. The harness split-ignore special case (tracking .ai/workflow/ and .ai/solution-acceptance.json while ignoring only .ai/runs/) does not apply here: this repo has neither, and no reference to solution-acceptance. If it ever enables solution-acceptance, adopt that split by narrowing the pattern to /.ai/runs/ rather than by appending ! negations, which git cannot honour under an excluded parent directory.

Verification

git check-ignore -v .ai/runs
  -> .gitignore:10:/.ai/  .ai/runs

git check-ignore --no-index -v packages/agent-memory-sync/.ai/AGENTS.md
  -> not ignored (exit 1)

rg --hidden --files -g '**/.ai/**'
  -> all 8 package docs still discoverable

Diff is one file, 7 insertions. Reviewed by a review subagent over two passes; the second pass ran 12 deterministic probes with controls and approved with no finding above low.

Refs: b2c6efec-629f-49b2-82b0-6685966bcece