ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts

- ci.yaml: no more @latest — pinned to released versions; supply-chain audit clean (govulncheck gates CI, npm audit gate, lockfiles committed, npm ci)
- check-env-docs.py: detects env vars read via the getEnv() helper (R2_* blind spot closed); 42 vars documented
- .gitignore: .sisyphus/ review reports

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

.gitignore

@@ -69,7 +69,24 @@ sabredav/vendor/
 composer.lock
 
 # ------------------------------------
-# 5. Local Tools and Notes
+# 5. Obsidian vault junk (machine-local state / plugin binaries)
+# ------------------------------------
+
+# Untitled canvas scratch file
+obsidian/Untitled.canvas
+
+# Volatile per-session workspace/graph/view state
+obsidian/.obsidian/workspace.json
+obsidian/.obsidian/graph.json
+obsidian/.obsidian/appearance.json
+obsidian/.obsidian/core-plugins.json
+
+# Plugin binaries (multi-MB main.js files) — regenerated on plugin install
+obsidian/.obsidian/plugins/
+obsidian/Crussell/.obsidian/plugins/
+
+# ------------------------------------
+# 6. Local Tools and Notes
 # ------------------------------------
 
 # Bruno testing environments (keep collection files, ignore secrets)
@@ -83,6 +100,10 @@ bruno/*/environments/
 .Trash/
 Thumbs.db
 
+# Python bytecode
+__pycache__/
+*.pyc
+
 # ------------------------------------
 # Git-specific
 # ------------------------------------
@@ -102,3 +123,4 @@ nginx/*.log
 
 # Temp files
 frontend/node_modules/.vite-temp
+.sisyphus/