sync .fossil-settings/ignore-glob with .gitignore intent

The fossil ignore list had drifted well behind .gitignore (missing *.log,
lib_tcl8/9, modules_tcl8/9, vendorbuilds, scratch*, src/testdata,
src/scriptapps/test_*, src/buildsuites, nested _build/_aside, and using
.punkcheck where git has *.punkcheck; carrying a stale 'builds' entry with
no git counterpart). Rewritten to mirror .gitignore as the canonical
statement of intent, translated for fossil glob semantics (verified
empirically against fossil 2.28 with a scratch repo): no negation exists,
so bin/* is ignored wholesale with the source-controlled bin exceptions
(AGENTS.md, *.cmd, *.kit, *.tcl, *.sh, *.bash) handled by explicit
'fossil add' (ignore-glob does not affect already-managed files); a bare
directory name prunes its whole tree; * crosses directory separators; git
patterns matching at any depth get an additional */ variant; # comment
lines are honoured. The header documents the derivation and the semantic
translation rules.

Verification against the live checkout: extras drop 10108 -> 2855 with no
bin/log/scratch leakage; zero extras are git-ignored (no under-ignoring);
git-tracked files invisible to fossil reduce to the designed bin exception
set plus fossil's own generated manifest files and a vendored nmakehlp.exe
(*.exe - needs explicit fossil add, as in git).

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

.fossil-settings/ignore-glob

@@ -1,38 +1,42 @@
+#Derived from .gitignore (the canonical statement of ignore intent) - keep in sync manually.
+#Fossil glob semantics differ from git (verified fossil 2.28):
+# - no negation patterns: the tracked exceptions under bin/ (AGENTS.md, *.cmd, *.kit, *.tcl,
+#   *.sh, *.bash) cannot be expressed - bin/* is ignored wholesale and source-controlled bin
+#   items must be explicitly 'fossil add'ed (ignore-glob does not affect already-managed files)
+# - a bare directory name prunes the whole tree; * crosses directory separators
+# - git patterns intended to match at any depth need an additional */ variant here
 .git
 CVS
-bin/*.exe
-bin/*.zip
-bin/*.bak
-bin/*.ps1
-bin/tools
-bin/runtime
-bin/*test*
+
+#bin is primarily build output - tracked exceptions by explicit add (see header)
+bin/*
+
+#directories for compiled/built Tcl packages - purely output
 lib
-#The directory for compiled/built Tcl modules
+lib_tcl8
+lib_tcl9
 modules
-#The buildsuites output folder
-builds
+modules_tcl8
+modules_tcl9
+vendorbuilds
 
-localdoc
+#Temporary files e.g from tests
+tmp
 
 .vscode
+*/.vscode
 .claude
+*/.claude
 .omo
-
-#subfolder for temporary reference files - not source controlled
-#we may use git clone to get a copy of the reference files - but we don't want to track them in the repo
-TEMP_REFERENCE
-
-#Temporary files e.g from tests
-tmp
+*/.omo
 
 logs
 _aside
-
-#working directories
+*/_aside
 _build
-src/_build
-src/docgen
+*/_build
+scratch*
+*/scratch*
 
 #Built documentation
 html
@@ -41,22 +45,41 @@ md
 doc
 
 test*
+src/testdata
+src/scriptapps/test_*
+
+#temp ignore - not ripe
+src/buildsuites
+
+#review
+src/docgen
+
+#local developer notes
+localdoc
 
 #Built tclkits (if any)
-#punk*.exe
-#tcl*.exe
 *.exe
 
+#subfolder for temporary reference files - not source controlled
+TEMP_REFERENCE
+*/TEMP_REFERENCE
+
+#fossil database files (fossil auto-ignores its own control files; an in-tree repo file would otherwise list as an extra)
+*.fossil
+
 #miscellaneous editor files etc
 *.swp
+*.log
 
-
-.punkcheck
+*.punkcheck
 
 todo.txt
+*/todo.txt
 
 zig-cache
+*/zig-cache
 zig-out
+*/zig-out
 release
 debug
 build