Adds read_gitignore() (pub(crate), root-only, nested cascade deferred) and merges its patterns as a 5th group in build_overrides(). Trailing- slash patterns (dist/) are normalized to also emit a stem/** glob so files inside the directory are matched when is_dir=false. Two new tests cover both the happy path and the missing-file no-op. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>