infra(gitignore): track specs/ + carve out private .claude/

The repo-level .gitignore had a blanket *.md rule with only
CHANGELOG.md exempted. Two adjustments:

- Allow specs/ to be tracked (design docs / RFCs live here, public).
- Restrict the README.md exception to the root (/README.md) so that
  per-directory README files (e.g. tests/fixtures/releases/README.md)
  stay ignored as before — no unintended scope creep.
- Explicitly ignore /.claude/, the private dev-docs sub-repo that
  lives inside the working tree but is versioned and pushed
  separately.

CHANGELOG: Internal entry.

.gitignore

@@ -74,5 +74,11 @@ docs/
 # .md files (project-level Markdown is brol-y; allow-list the ones we track)
 *.md
 !CHANGELOG.md
+!/README.md
+!specs/
+!specs/**/*.md
+
+# Private dev docs (separate git repo inside; see .claude/CLAUDE.md)
+/.claude/
 
 #

CHANGELOG.md

@@ -15,6 +15,16 @@ callers).
 
 ## [Unreleased]
 
+### Internal
+
+- **`specs/` is now tracked.** The repo-level `.gitignore` had a
+  blanket `*.md` rule with only `CHANGELOG.md` allow-listed. Added
+  explicit exceptions for `/README.md` (root only — avoids
+  unintentionally exposing fixture READMEs) and `specs/**/*.md` so the
+  new design-doc directory ships with the project. Also added an
+  explicit `/.claude/` ignore line for the private dev-docs sub-repo
+  that sits inside the working tree but is versioned separately.
+
 ### Fixed
 
 - **Multi-episode chain (e.g. `S14E09E10E11`) now collapses to a full