chore(gitignore): ignore root reports written by Makefile targets

[cristim]

Summary

Three Makefile targets write reports at the repo root, and none of these files was ignored, so each showed up as untracked and could be committed by accident:

• make test-coverage writes coverage.html.
• make security-scan-go writes gosec-report.json.
• make complexity-report writes complexity-report.txt.

This PR adds root-anchored patterns for all three. They match the list make clean removes (Makefile:59); coverage.out was already covered by *.out.

Closes #11

Verification (local, macOS, at 55d138a)

• Before (origin/main config): git check-ignore matches none of the three files (exit 1).
• After: I ran make complexity-report, make security-scan-go and make test-coverage in the worktree. git check-ignore -v attributes each output to .gitignore:34-36, and git status --untracked-files=all shows only the .gitignore edit. make security-scan-go first exited 2 under the machine default Go 1.27: the pinned gosec binary, built with Go 1.26, could not read Go 1.27 export data. That is a setup failure, not findings. Re-run with GOTOOLCHAIN=go1.26.9 (go.mod), it exits 0 with no findings and writes gosec-report.json, which is ignored.
• Anchoring: a nested tools/x/coverage.html stays unignored.
• git ls-files -i -c --exclude-standard is empty, so no tracked file matches the new patterns.

Review

A non-author reviewer (Sonnet, high effort) did two passes and reproduced the check-ignore results. It searched the Makefile, scripts/, workflows and .goreleaser.yml for other root artifacts and found none. No actionable findings. CodeRabbit is not pinged because the org's CR quota is exhausted.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 53 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 63 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-mcp/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 0b2488fb-e4d6-49a6-acf7-382012a826bd

📥 Commits

Reviewing files that changed from the base of the PR and between 99ad252 and 55d138a.

📒 Files selected for processing: 1

• .gitignore

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Correction to the verification section (body updated): the earlier exit 2 from make security-scan-go was a local toolchain mismatch (pinned gosec built with Go 1.26 vs machine Go 1.27), not gosec findings. With GOTOOLCHAIN=go1.26.9 it exits 0 with no findings. The check-ignore evidence is unchanged. [claude-mcp-impl]

[cristim]

Merge-driver verdict: CLEAN at 55d138ab9cdb5f5f50567ca660fa9af463447eb2

An independent adversarial reviewer (Sonnet, high effort, cold brief, not the author) reviewed the full diff. It found no blocking findings.

• Verified: the Makefile writes four files at the repo root.

  • coverage.out and coverage.html (Makefile L52-53)
  • complexity-report.txt (L93)
  • gosec-report.json (L98, through scripts/run-gosec.sh)

  No script under scripts/ writes anything else to the root.

• Local verification (real, macOS, on the PR tree):

  • git check-ignore -v matches all four: .gitignore:34-36 covers three of them, and the existing *.out rule at L29 covers coverage.out.
  • git ls-files -ci --exclude-standard prints nothing, so no tracked file becomes ignored.
  • The patterns are root-anchored.

• CI: all green at this SHA.

• CodeRabbit: skipped (quota). The gate allows this because the independent review and exact-revision local verification cover the SHA.

• Labels: match HYG-06: .gitignore gaps for Makefile-produced root artifacts [mcp part] #11.