Fix the budget gate and add CI, lint and coverage guards

- check_budget.py escalated a hard index-row violation to 'warn' on both
  branches, so INDEX_ROW_HARD could never fail anything. It fails now, and
  tests/unit/test_budget_measurement.py pins both thresholds.
- The corpus note counted scripts/__pycache__/*.pyc, so the same commit
  reported 27 scripts after the suite had run and 16 on a clean checkout.
- TOKENS_PER_CHAR is re-derived from a measurement (26,795 chars -> 6,065
  tokens = 4.418); the comment's old figure and its arithmetic were both
  wrong for this file.
- check_repo.py's yaml sentinel carries the type ignore, so mypy is clean
  with PyYAML installed as well as without it.
- The CPUID test now skips with the probe's own note on a host without
  CPUID instead of failing, and pytest.ini points at tests/README.md, which
  exists, instead of an EXTENSION file that never did.

Tooling: .flake8 (a measured 120-column limit), .gitattributes, .gitignore
and .github/workflows/ci.yml (the five gates, the suite on 3.11-3.14 and a
lint job), which is what CONTRIBUTING.md already claimed CI runs. The
pull-request template it refers to now exists.

Content: pitfalls P26-P34 -- the analysis-level failures the catalogue was
missing (sampling read as observation, a self-built parser trusted, a
verification that could not have failed, a shell-mangled command line) --
registered in the symptom index and its routing mirror. FINDINGS F11-F15
record the defects above.

Tests: the coverage guard derives its subject from scripts/ rather than a
hand-written list, pe_triage.py and pe_diff.py gain their first tests, and
plan.py / preflight.py are declared uncovered with reasons.

.gitignore

@@ -0,0 +1,61 @@
+# Local build products. The kit ships source only: every PE the tests need is generated into a
+# pytest temp directory by skills/exe-reverse/scripts/make_fixture_pe.py, so nothing here is an input
+# the repository could not rebuild.
+*.obj
+*.lib
+*.exp
+*.ilk
+*.idb
+*.i64
+*.til
+*.nam
+*.map
+
+# Working data -- never commit samples, dumps or captures.
+*.exe
+*.dll
+*.sys
+*.ocx
+*.cpl
+*.scr
+*.pdb
+*.zip
+*.7z
+*.bin
+*.dmp
+*.etl
+*.pcap
+*.png
+*.jpg
+
+# local scratch
+_tmp/
+out/
+work/
+audit_out/
+
+# local extension-pass workspace: toolchains, vendor SDKs, unpacked installers, scratch notes.
+# Nothing under tools/ belongs to the repository -- the skill's own evidence record lives in
+# docs/tool-verification/ and carries no target identity or vendored binaries.
+tools/
+
+# Local copies of the third-party write-ups an absorption pass reads. They are someone else's text,
+# not content of this repository: what ships is the absorbed method under an `inferred` label, plus
+# the anonymized source line in docs/tool-verification/EXTENSION-absorption-*.md. One `git add -A`
+# is all it would take to commit them, so the rule is explicit here rather than resting on "nobody
+# has added them yet".
+.ref/
+
+# sandbox installs made while testing `npx skills add .` against this repo
+.claude/
+.agents/
+*.log
+*.jsonl
+
+# python / editors
+__pycache__/
+*.pyc
+.venv/
+.vscode/
+.idea/
+.DS_Store