chore: remove committed qntm runtime secrets

[vessenes]

What changed

• remove committed local identity, conversation key, cursor, and transcript state from .company/qntm
• remove the tracked Beads runtime credential key
• ignore .company/qntm and the Beads credential key at both repository and Beads-directory levels

Why

PR #8 exposed copies of these test artifacts, but the same classes of runtime state are also reachable from main. Local identity and conversation state should never be versioned, even when used only for testing.

Scope

This removes the artifacts from future checkouts and prevents recommits. It does not rewrite existing shared history or the contributor-owned fork behind PR #8. Rotate the test keys as planned; a full history rewrite would require separate repository-wide coordination.

Validation

• ignore rules verified for identity.json, conversations.json, and .beads-credential-key
• no production code changed
• downstream PR Add cross-surface UI acceptance gate #22 runs the full Python and cross-surface acceptance gates

Stack

This PR targets PR #21. PR #20, PR #16, PR #18, PR #17, and PR #22 are serialized above it.