chore(gitignore): production-hardening patterns

Adds the credential + cache + coverage patterns that were either
missing or scattered across the existing .gitignore. Specifically:

  - *.pem / *.key / *.p12 / *.pfx / credentials*.json / secrets/ —
    never commit auth material to a public SDK repo.
  - _deps/ / build-*/ — explicit (build/ already covered the common
    case but downstream FetchContent + multi-config layouts can land
    these outside build/).
  - *.gcov / *.gcda / *.gcno / *.profraw / *.profdata / coverage/ —
    coverage instrumentation output.
  - .DS_Store / Thumbs.db — OS noise from cross-platform contributors.

Idempotent: gated by a 'Production-hardening patterns' sentinel
comment so re-running the patch script is safe.

Author: Reddimus

.gitignore

@@ -18,3 +18,37 @@ Thumbs.db
 # Env
 .env
 *.pem
+
+# === Production-hardening patterns (added 2026-05-02) ===
+# Credentials — never commit secrets to a public SDK
+*.pem
+*.key
+*.p12
+*.pfx
+credentials.json
+credentials*.json
+secrets/
+service-account*.json
+gha-secrets.txt
+
+# Build cache
+_deps/
+build-*/
+
+# Coverage + analysis artifacts
+*.gcov
+*.gcda
+*.gcno
+coverage/
+*.profraw
+*.profdata
+
+# Sanitizer / valgrind output
+asan.log
+ubsan.log
+*.callgrind
+*.cachegrind
+
+# OS noise
+.DS_Store
+Thumbs.db