ci: consolidate trivial gates into hygiene.yml

[acamarata]

Summary

• Merges clean-root.yml and generated-file-gate.yml (each a few seconds of real work, no toolchain) into one hygiene.yml job with a single checkout — 1 runner claim per push instead of 2. Neither was a required branch-protection check.
• Trigger scope is the union of the two originals (clean-root ran on [main, develop], generated-file-gate on [main] only) — broader, not narrower, so nothing that used to run stops running.
• ci.yml and gitleaks.yml are untouched.
• No paths: filters added anywhere. hygiene.yml needs to see every changed file to catch a committed generated file in any path. ci.yml/gitleaks.yml carry required checks — GitHub does not skip a required check just because paths-ignore excluded a push from triggering it, it blocks the merge waiting on a check that never runs. Path-filtering a required-check workflow is unsafe, so it was deliberately not attempted.

Safety

• Required check Lint + Typecheck + Test (client + mobile) (job gate in ci.yml) — file untouched, byte-identical to origin/main.
• Required check gitleaks (job gitleaks in gitleaks.yml) — file untouched.
• No checks removed, no continue-on-error, no loosened assertions.

Test plan

• actionlint on all workflow files post-change: exit 0
• actionlint on the pre-change baseline (origin/main): exit 0 — no new findings
• Diffed ci.yml and gitleaks.yml against origin/main: identical