Keep catalog control state out of Git

[myobie]

Summary

Keep the host-local catalog control directory out of Git transport.

st2 now adds .st2/ to the repository-local .git/info/exclude when it initializes catalog control state or bootstraps a catalog.

Non-Git catalogs do not require Git. Repeated initialization preserves existing exclusion bytes and does not add duplicate lines.

Reason

An incomplete-apply marker is authoritative on every host. If Git transports .st2/, that copied marker blocks declaration reads in each destination clone.

Existing catalogs

The README tells operators to add the exact .st2/ line before the next sync. If Git already tracks .st2, the README gives git -C "$CATALOG" rm -r --cached -- .st2 and explains that committing the staged removal preserves local control files. The VRS records the host-local boundary and fail-closed behavior.

Validation

• Git-backed initialization writes one effective exclusion and preserves existing bytes.
• Atomic bootstrap writes the containing repository exclusion.
• A copied incomplete marker blocks destination catalog reads.
• Full catalog-apply, catalog-selection, invariant, library, formatting, and strict clippy gates pass.
• Workspace tests pass with four exact, independently established baseline skips.

This pull request is independent of PR #159 and the A04 wording follow-up.