infra(gitignore): track specs/ + carve out private .claude/

The repo-level .gitignore had a blanket *.md rule with only
CHANGELOG.md exempted. Two adjustments:

- Allow specs/ to be tracked (design docs / RFCs live here, public).
- Restrict the README.md exception to the root (/README.md) so that
  per-directory README files (e.g. tests/fixtures/releases/README.md)
  stay ignored as before — no unintended scope creep.
- Explicitly ignore /.claude/, the private dev-docs sub-repo that
  lives inside the working tree but is versioned and pushed
  separately.

CHANGELOG: Internal entry.

.gitignore

@@ -74,5 +74,11 @@ docs/
 # .md files (project-level Markdown is brol-y; allow-list the ones we track)
 *.md
 !CHANGELOG.md
+!/README.md
+!specs/
+!specs/**/*.md
+
+# Private dev docs (separate git repo inside; see .claude/CLAUDE.md)
+/.claude/
 
 #