feat(install-ai): gitignore the full personal-tooling set, add backfill sweep

A gitignore-mode project only ignored .ai/. CLAUDE.md was left untracked but not ignored, so an accidental git add or a codify run could still commit a personal CLAUDE.md, the private rule copies under .claude/, or an AGENTS.md. install-ai now ignores the whole set (.ai/, .claude/, CLAUDE.md, AGENTS.md) at bootstrap, line-idempotent so an existing .gitignore isn't duplicated.

.claude/ goes in the set because it's rulesets-owned (copies of claude-rules/*.md plus the language bundle's rules, hooks, and settings), re-synced from rulesets every startup, so git isn't how it travels. Ignoring it also keeps those private rule copies out of the repo, which ignoring CLAUDE.md alone would miss. The gate is unchanged: track-mode projects (personal/doc repos, team repos sharing config) keep tracking the set.

sweep-gitignore-tooling.sh backfills the set across existing gitignore-mode projects, idempotent and skipping track-mode by design. It warns when a now-ignored path is already tracked, since the ignore won't untrack it. protocols.org states the policy once.

1 files changed, 21 insertions, 0 deletions

diff --git a/scripts/tests/install-ai.bats b/scripts/tests/install-ai.bats
index dca70ea..8e91770 100644
--- a/scripts/tests/install-ai.bats
+++ b/scripts/tests/install-ai.bats
@@ -36,12 +36,33 @@ teardown() {
   [ -d "$TEST_HOME/code/fresh/.ai/retrospectives" ]
   [ -f "$TEST_HOME/code/fresh/.ai/protocols.org" ]
   [ -f "$TEST_HOME/code/fresh/.ai/notes.org" ]
+  # Gitignore mode ignores the whole personal-tooling set, not just .ai/.
   grep -qFx ".ai/" "$TEST_HOME/code/fresh/.gitignore"
+  grep -qFx ".claude/" "$TEST_HOME/code/fresh/.gitignore"
+  grep -qFx "CLAUDE.md" "$TEST_HOME/code/fresh/.gitignore"
+  grep -qFx "AGENTS.md" "$TEST_HOME/code/fresh/.gitignore"
   # Top-level inbox/ is created so the project is an inbox-send target.
   [ -d "$TEST_HOME/code/fresh/inbox" ]
   [ -f "$TEST_HOME/code/fresh/inbox/.gitkeep" ]
 }
 
+@test "install-ai --gitignore: appends only the missing tooling lines" {
+  mkdir -p "$TEST_HOME/code/partial"
+  (cd "$TEST_HOME/code/partial" && git init -q)
+  # Project already ignores .ai/ and CLAUDE.md from a prior convention.
+  printf '# Personal tooling\n.ai/\nCLAUDE.md\n' > "$TEST_HOME/code/partial/.gitignore"
+
+  run bash "$INSTALL_AI" --gitignore "$TEST_HOME/code/partial"
+
+  [ "$status" -eq 0 ]
+  # The two already-present lines are not duplicated.
+  [ "$(grep -cFx '.ai/' "$TEST_HOME/code/partial/.gitignore")" -eq 1 ]
+  [ "$(grep -cFx 'CLAUDE.md' "$TEST_HOME/code/partial/.gitignore")" -eq 1 ]
+  # The two missing lines were added.
+  grep -qFx ".claude/" "$TEST_HOME/code/partial/.gitignore"
+  grep -qFx "AGENTS.md" "$TEST_HOME/code/partial/.gitignore"
+}
+
 @test "install-ai: creates top-level inbox/ in --track mode too" {
   mkdir -p "$TEST_HOME/code/inbox-track"
   (cd "$TEST_HOME/code/inbox-track" && git init -q)