Add gitignore-claude template and wire into registration flows

Introduce scripts/project_rules/gitignore-claude.template with the fleet
pattern that tracks .claude/rules/ while ignoring machine-local Claude state.
ensure_gitignore_claude_rules.py applies it during statehub register,
register_project.sh, and update_agent_instruction_files fleet regen.

tests/test_ensure_gitignore_claude_rules.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from scripts.ensure_gitignore_claude_rules import ensure_claude_gitignore, snippet_present
+
+
+def test_ensure_claude_gitignore_creates_file(tmp_path: Path):
+    gitignore = tmp_path / ".gitignore"
+
+    assert ensure_claude_gitignore(gitignore) is True
+    text = gitignore.read_text(encoding="utf-8")
+    assert snippet_present(text)
+    assert "!.claude/rules/" in text
+
+
+def test_ensure_claude_gitignore_replaces_blanket_ignore(tmp_path: Path):
+    gitignore = tmp_path / ".gitignore"
+    gitignore.write_text("# Claude Code local state\n.claude/\n", encoding="utf-8")
+
+    assert ensure_claude_gitignore(gitignore) is True
+    text = gitignore.read_text(encoding="utf-8")
+    assert ".claude/" not in text or "!.claude/rules/" in text
+    assert "!.claude/rules/*.md" in text
+
+
+def test_ensure_claude_gitignore_is_idempotent(tmp_path: Path):
+    gitignore = tmp_path / ".gitignore"
+
+    assert ensure_claude_gitignore(gitignore) is True
+    assert ensure_claude_gitignore(gitignore) is False
+
+
+def test_ensure_claude_gitignore_appends_when_other_rules_present(tmp_path: Path):
+    gitignore = tmp_path / ".gitignore"
+    gitignore.write_text(".venv/\n", encoding="utf-8")
+
+    assert ensure_claude_gitignore(gitignore) is True
+    text = gitignore.read_text(encoding="utf-8")
+    assert text.startswith(".venv/\n")
+    assert "!.claude/rules/" in text

tests/test_statehub_register_cli.py

@@ -89,7 +89,9 @@ def test_write_registration_files_primes_codex_repo(tmp_path: Path):
         "AGENTS.md",
         ".custodian-brief.md",
         "DEMO-WP-0001-statehub-bootstrap.md",
+        ".gitignore",
     }
+    assert "!.claude/rules/" in (tmp_path / ".gitignore").read_text()
     assert (tmp_path / "INTENT.md").read_text() == "# INTENT\n\nDemo service intent.\n"
     assert "**Repo slug:** demo-service" in (tmp_path / "AGENTS.md").read_text()
     assert "Run the demo service." in (tmp_path / "SCOPE.md").read_text()