fix: stop tracking the runtime control channel, and keep it that way

[suleimansh]

The regression

#1311 untracked .the-framework/control.jsonl and added nothing to hold the line. Eighteen hours later a run's own branch committed an empty one straight back onto main, riding in with #1309.

Tracking it is what #1298 is about: the daemon rewrites the control channel on every steer, so a tracked copy dirties every checkout it exists in and becomes a delete-vs-modify conflict between two machines.

This untracks it again, plus the copy under packages/the-framework/.the-framework/ that a run executing inside the package directory left behind at the #1092 rename. Both files are zero bytes.

The guard is the actual fix

A second untracking with no guard would just be waiting for the third one. The invariant is wider than one filename: .the-framework/ is transient except the committed DB (#313/#857), so a tracked run.json or events.jsonl would churn a checkout the same way.

The new test in control.test.ts asserts that every tracked path under a .the-framework/ directory is one of the four committed kinds:

• .gitignore
• LOGS.md
• conversations/**
• <user>/sessions/**

Anything else fails the test and names the offending paths. It skips itself when git rev-parse fails, so an installed package outside a git checkout still tests clean.

Verification

Proof-by-revert is built in: on main as it stands the test fails, naming both files.

✖ no runtime state under .the-framework is tracked in git (#1298/#1311)
  runtime state is tracked:
  .the-framework/control.jsonl
  packages/the-framework/.the-framework/control.jsonl

With the two removals, the framework suite is 1551 pass / 0 fail (1 skipped).

No changeset

Nothing here ships in dist, so the published package is byte-identical. This is checkout hygiene, not a release.