fix(gitignore): switch to whitelist approach for .beads/.gitignore (#473)

The .beads/.gitignore now ignores everything by default and explicitly
whitelists tracked files. This fixes confusion about which files to
commit when using protected branches workflow.

Changes:
- Use `*` to ignore all by default, then `!file` to whitelist
- Fix config.json -> config.yaml (wrong filename in negation)
- Update doctor check to validate new patterns
- Update PROTECTED_BRANCHES.md documentation
- Simplify git add instructions to just `git add .beads/`

Fixes #473

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cmd/bd/init_test.go

@@ -115,21 +115,15 @@ func TestInitCommand(t *testing.T) {
 			if err != nil {
 				t.Errorf(".gitignore file was not created: %v", err)
 			} else {
-				// Check for essential patterns
+				// Check for essential patterns (whitelist approach - GitHub #473)
 				gitignoreStr := string(gitignoreContent)
 				expectedPatterns := []string{
-					"*.db",
-					"*.db?*",
-					"*.db-journal",
-					"*.db-wal",
-					"*.db-shm",
-					"daemon.log",
-					"daemon.pid",
-					"bd.sock",
-					"beads.base.jsonl",
-					"beads.left.jsonl",
-					"beads.right.jsonl",
-					"!issues.jsonl",
+					"*",             // Blanket ignore
+					"!.gitignore",   // Whitelist gitignore itself
+					"!issues.jsonl", // Whitelist JSONL
+					"!metadata.json",
+					"!config.yaml",
+					"!README.md",
 				}
 				for _, pattern := range expectedPatterns {
 					if !strings.Contains(gitignoreStr, pattern) {