chore: prepare protected pull request workflow

[Willxup]

Summary

• Ignore project-local .agents/ and .worktrees/ directories.
• Keep the FlowLens project Skill and linked worktrees out of repository status and commits.
• Fetch full Git history in CI so Gitleaks can scan pull request commit ranges under protected-main rules.

Verification

• git diff --check
• GitHub Actions workflow YAML parsed successfully
• Verified both local paths with git check-ignore
• Previous PR CI passed source, unit, browser, release-contract, and Linux build steps; only the shallow-history Gitleaks step failed
• Both commits include Signed-off-by (DCO)

Compatibility

None. No application code or runtime behavior changed.