Ignore semantics

Template discovery and scaffolding walk the tree through one ignore pipeline, in this order:

.gitignore files inside the repository tree — honored by default. For clean checkouts this is a no-op (ignored files aren’t committed); it matters for committed junk and any future local-path template sources.
The template’s [star] ignore globs — matched against paths relative to the template root, layered into the walk as overrides:
```
[star]
ignore = ["target", "*.log", "secrets/"]
```
.git directories — always skipped.

.gitignore defaulting on matches user expectation from every other scaffolder. There is no opt-out flag yet — --no-gitignore will only exist if someone actually needs it.

Alongside the pipeline, materialization adds two unconditional rules:

star.toml is never copied — at any depth, it is star metadata, not project content.
Symlinks are copied as symlinks; anything escaping the template root is skipped with a warning (see security).