chore: remove tracked dependency output

[Jeremy1844]

Root cause

Three editor-backup files under node_modules remained tracked after dependency output was added to .gitignore. A clean locked install therefore dirtied the repository, and there was no repository-owned check preventing recurrence.

Audit root: ADV-2026-0050 / RC-0050 only.

Regression and fix

• Base: ef36769c5ae90a1aec9ae6c8f39332aaa02bf8e0
• Expected-red check: ea206f0039520da09f5f64842343067176d53770 exits 1 and names exactly the three tracked backup files.
• Cleanup: 04e3a31d31083ddad168b83c059ae1d221cd6ca1 removes those files and anchors the dependency-output ignore rule.
• Current head: 9eebc453167bdb48992ea26f6f94fc0da1b4be4d; the final one-line follow-up pins actions/checkout to the independently verified official v7.0.1 commit.
• The new check uses Ubuntu 24.04, read-only contents permission, disabled persisted credentials, a five-minute timeout, and concurrency cancellation.

Local evidence on the exact head:

• repository-hygiene body: pass
• Actionlint 1.7.12: pass
• npm ci --ignore-scripts with Node 24.18.0/npm 11.16.0: pass; worktree remains clean
• diff check, strict object check, secret scan: pass

The legacy graph still reports 27 advisories and its native Sass build is broken. Those are deliberately not hidden here; the separate Dart Sass root follows after this prerequisite.

Overlap and safety

Open PRs #29, #30, and #31 modify package metadata only; this change has zero file overlap with all three. No application, content, payment, deployment, persistence, schema, user-data, translation, media, PDF, or EGW material changes.

No migration is required. Rollback is a normal revert, but it would restore the dirty-tree defect. Keep this draft until the hosted hygiene job is approved and passes.