chore: remove stray artefact files and harden .gitignore Refs #2364

Remove four files that were accidentally committed to the repository root:
- EOF and PYEOF: empty files from malformed shell heredocs
- session-ses_2a04.md: agent session plan (6615 lines) not belonging in VCS
- ~/projects/personal/.../terraphim_mcp_server-pa: home-directory stub
  created by an unexpanded tilde in a git command (also removes sensitive path)

Add .gitignore patterns to prevent recurrence:
- /EOF, /PYEOF: heredoc accident guards
- /pr_review_files/: PR review working directories
- /.reconcile_impl*.rs, /*.pr_gate_result*.rs: hidden artefact RS files
- /*_new.rs, /*_old.rs, /cursor_*.rs: working-copy RS snapshots
- /session-ses_*.md, /pr_review_*.md: agent session and review outputs
- ~/: home-directory stub guard

Author: Test User

.gitignore

@@ -133,3 +133,21 @@ pi-session-*.html
 # Client project data - never track
 projects/odilo/
 # CI test fix verification
+
+# Agent artefact files accidentally committed to repo root (#2342, #2364)
+# These patterns match working-copy snapshots and review outputs from
+# PR-reviewer/verifier/validator agents that should not be committed.
+/pr_review_*.md
+/*.pr_gate_result*.rs
+/*.reconcile_impl*.rs
+/*_new.rs
+/*_old.rs
+/cursor_*.rs
+/session-ses_*.md
+/security_audit_report_*.md
+/pr_review_files/
+# Heredoc accidents (bare EOF/PYEOF files created by malformed shell heredocs)
+/EOF
+/PYEOF
+# Home-directory stubs (literal '~' dir created by unexpanded tilde in git commands)
+~/