chore: verify no coverage / venv artifacts are tracked in git #97

Problem

Local development can produce build / coverage artifacts (`.coverage`, `.venv/`, etc.) that should not ship in the repository. `.gitignore` lists them, but a one-time audit is needed to confirm none slipped in before public release.

Proposed solution

Run an audit and remove anything tracked that shouldn't be:

```sh
git ls-files | grep -E '(^|/).coverage$|(^|/).venv(/|$)|(^|/)pycache/|.pyc$'
```

Expected: empty output. If anything is returned, `git rm --cached` the offending paths and confirm `.gitignore` covers the pattern going forward.

Acceptance criteria

• Audit command run on a clean checkout
• Any tracked artifacts removed via `git rm --cached` in a follow-up commit
• `.gitignore` updated if any gap is found

Priority rationale

One-time hygiene before the repo becomes public; trivially cheap.