Auto-mode is LOCAL — gitignore .claude/settings.json on apply (un-commit the one in d87257a)

[alex-mextner]

From the ecosystem ROADMAP (§5). Manually corrected on wave-1 PRs; rig itself needs the fix.

What

.claude/settings.json (harness auto-mode, permissions.defaultMode: bypassPermissions) must be per-machine, gitignored — applied locally by rig apply, NOT committed. The committed declaration is rig.yaml harness.auto_mode.

• Fix rig to gitignore .claude/settings.json on apply.
• rig-cli's own .claude/settings.json was committed in d87257a — un-commit it.

Why

bypassPermissions is a local trust decision; committing it forces it on every checkout/contributor. The committed source of truth is the declarative rig.yaml, which rig materializes locally.

Acceptance

• rig apply writes .claude/settings.json locally and ensures it is gitignored (the narrow ignore pattern: ignore .claude/*, un-ignore nothing harness-secret).
• rig-cli's committed .claude/settings.json (d87257a) is removed from the tree.
• rig.yaml harness.auto_mode remains the committed declaration.