chore: remove Khalsa bot-session scratch + gitignore root scratch classes

Winter's auto-sync swept ~2.4MB of Khalsa troubleshooting scratch (SC session dumps,
diag .ps1/.b64, ticket JSON) into repo root via git add -A. Removed those and added
gitignore rules for root dot-.ps1/.b64/.err/.vbs/.tmp + the leaked .json families
(prefix-listed to keep .hosts.json/.devs.json/.mcp.json.example protected).

.gitignore

@@ -155,3 +155,33 @@ temp/
 
 # EDR isolation watcher local state (no secrets, per-host)
 .claude/scripts/.edr-watch-state.json
+
+# --- Bot/session scratch that leaks to repo root via `git add -A` (added 2026-07-17) ---
+# Root dot-prefixed .ps1/.b64/.err/.vbs are ALWAYS scratch here (real scripts live in
+# .claude/scripts/), so blanket them like the existing .*.txt/.*.sh rules.
+.*.ps1
+.*.b64
+.*.err
+.*.vbs
+.*.tmp
+# Scratch .json families — a blanket .*.json is UNSAFE (.hosts.json/.devs.json/.mcp.json.example
+# are legit tracked files), so list transient per-session families by prefix/name instead:
+.khalsa-*
+.glaztech-*
+.neptune-*
+.unifi-*.json
+.uni-*.json
+.sy_*.json
+.syncro-*.json
+.msp-*.json
+.bb-*.json
+.signins.json
+.sc-tps.json
+.mon.json
+.tkt.json
+.rep.json
+.uadd.json
+.bill.json
+.gmeta.json
+.oc.json
+.hosts2.json