chore: protect local trust and generated evidence

[WindDAnalytics]

Summary

Strengthens .gitignore before public launch.

Adds explicit exclusions for:

• .env and environment-specific credential files
• project-local .quantumd signing and trust state
• generated evidence runs, executions, keys, plans, approvals, submissions,
  results, and authorization records

The patterns intentionally preserve:

• the sanitized example fixture at
  examples/quantum_kernel/evidence/evidence.json
• the src/quantumd/evidence/ implementation package
• public .env.example, .env.sample, and .env.template files

The tracked example evidence fixture was parsed and scanned for
high-confidence credential material before this change.

Validation

• all required ignore patterns are present
• nested local trust state is ignored
• generated evidence subdirectories are ignored
• source code under src/quantumd/evidence/ remains visible
• the sanitized example evidence fixture remains visible
• public environment templates remain visible
• git diff --check passed

Visibility

This pull request does not change repository visibility.