Add CLAUDE.md and harden .gitignore

Document the fork's architecture and dev/verify workflow for future work
(no test framework; verify via pure-logic functions and generated
command_var). Extend .gitignore to exclude .claude/ local config
(machine-specific paths + personal permission allowlists), common secret
file patterns, and editor/OS junk, while keeping the shipped base_*.mpg
package data tracked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -1,7 +1,36 @@
+# Python build/cache artifacts
 __pycache__/
 *.pyc
 *.pyo
 build/
 dist/
 *.egg-info/
+
+# Compiled translations (generated from po/ at build time)
 src/devedeng/data/locale/
+
+# Claude Code local config / session state (machine-specific, may include
+# local paths and personal permission allowlists; not for sharing)
+.claude/
+CLAUDE.local.md
+
+# Local environment / secrets (defense-in-depth; nothing here today)
+.env
+.env.*
+*.pem
+*.key
+*.p12
+id_rsa*
+credentials*
+*.secret
+
+# Editor / OS junk
+.vscode/
+.idea/
+*.swp
+*~
+.DS_Store
+
+# Runtime/output artifacts this project can produce
+*.iso
+*.mpg.progress