gitignore: .hanzo/* not .hanzo/ — the negation only works on the glob form

Git never descends into an EXCLUDED DIRECTORY, so `.hanzo/` followed by
`!.hanzo/workflows/` does not re-include anything: the directory is pruned
before the negation is ever considered. My previous commit only landed the two
workflow files because I forced them with `git add -f`; the next workflow file
added would have been silently dropped, which is the same failure mode that left
this repo briefly with no CI at all.

Verified both ways rather than reasoned about — `git add` on a fresh file under
.hanzo/workflows/ is refused with `.hanzo/`, accepted with `.hanzo/*`.

hanzoai/universe already documents this exact trap in its own .gitignore; this
now matches that proven form.

.gitignore

@@ -36,14 +36,13 @@ GROK.md
 QWEN.md
 
 # Local databases and state
-.hanzo/
+.hanzo/*
 # …except the native CI/CD workflows, which are source of truth on
 # git.hanzo.ai. `.hanzo/` is ignored because it also holds local agent
 # scratch; the workflows are not scratch. Without this negation a repo can
 # delete its GitHub workflows and land NO replacement — which is exactly
 # what happened here on the first attempt.
 !.hanzo/workflows/
-!.hanzo/workflows/**
 .grok/
 
 # Documentation build