Version bump 0.18.0 -> 0.18.1. Carries all the v0.18 papercuts + the
post-v0.18 fixes shipped since 2026-04-24 (journey matrix, camp login
JWT bearer resolution, publish workflow trigger on v* tag push).

`uv lock` regenerated (was stale at 0.6.0 in the lockfile; carl-studio
line now reads 0.18.1).

Gitignore additions:
- carl.yaml — project-local training config. Users commonly put dataset
  paths AND sometimes secrets there; layered read by CARLSettings still
  works unchanged. Per CLAUDE.md "never log or persist secrets" this
  keeps accidental secret leaks out of commits. Commit a
  carl.yaml.example if you want to share config.

Workspace fix:
- `[tool.uv.workspace] exclude = ["packages/emlt-codec-ts"]` — the TS
  sibling package has no pyproject.toml and was making `uv lock` fail
  with "Workspace member … is missing a pyproject.toml". This had been
  blocking CI's `uv lock --check` step transparently.

Build verified: carl_studio-0.18.1.tar.gz + wheel produced locally.

Tag push of v0.18.1 after this commit will trigger the newly-fixed
publish workflow and push 0.18.1 to PyPI via OIDC trusted publishing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>