fix(gitignore): switch to whitelist approach for .beads/.gitignore (#473)

The .beads/.gitignore now ignores everything by default and explicitly
whitelists tracked files. This fixes confusion about which files to
commit when using protected branches workflow.

Changes:
- Use `*` to ignore all by default, then `!file` to whitelist
- Fix config.json -> config.yaml (wrong filename in negation)
- Update doctor check to validate new patterns
- Update PROTECTED_BRANCHES.md documentation
- Simplify git add instructions to just `git add .beads/`

Fixes #473

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.beads/.gitignore

@@ -1,33 +1,20 @@
-# SQLite databases
-*.db
-*.db?*
-*.db-journal
-*.db-wal
-*.db-shm
+# Ignore all .beads/ contents by default (local workspace files)
+# Only files explicitly whitelisted below will be tracked in git
+*
 
-# Daemon runtime files
-daemon.lock
-daemon.log
-daemon.pid
-bd.sock
+# === Files tracked in git (shared across clones) ===
 
-# Local version tracking (prevents upgrade notification spam after git operations)
-# bd-tok: Store version locally instead of in tracked metadata.json
-.local_version
+# This gitignore file itself
+!.gitignore
 
-# Legacy database files
-db.sqlite
-bd.db
-
-# Merge artifacts (temporary files from 3-way merge)
-beads.base.jsonl
-beads.base.meta.json
-beads.left.jsonl
-beads.left.meta.json
-beads.right.jsonl
-beads.right.meta.json
-
-# Keep JSONL exports and config (source of truth for git)
+# Issue data in JSONL format (the main data file)
 !issues.jsonl
+
+# Repository metadata (database name, JSONL filename)
 !metadata.json
-!config.json
+
+# Configuration template (sync branch, integrations)
+!config.yaml
+
+# Documentation for contributors
+!README.md