Add root .gitignore for workspace markers, build output, secrets and scratch files