fix: ignore downstream start-issue run ledgers

[dapi]

What changed

• add a nested template/.start-issue/.gitignore containing runs/
• keep downstream root .gitignore files untouched
• let the existing managed-payload install/update contract create the nested rule on both first adoption and later updates

Why

.start-issue/prompt.md already requires Run Ledger state under .start-issue/runs/ to be ignored by Git. The ignore rule existed only in this upstream repository's root .gitignore, which is outside template/ and therefore is not installed downstream. Putting the rule beside the generated state makes it an independent managed payload path, so it does not collide with a project's user-owned root .gitignore.

Workflow: Bug Fix

• Expected behavior: template/.start-issue/prompt.md states that .start-issue/runs/ is Git-ignored before the ledger is written.
• Actual behavior: a downstream repository with its own root .gitignore receives .start-issue/prompt.md but does not ignore the run ledger.
• Root cause: the only effective rule was in the upstream repository root, outside the installed template/ payload.
• Validation profile: standard; this changes installed template behavior without changing the CLI ownership contract or publishing a release.

Downstream impact

• Fresh memory-bank-cli init: creates the nested ignore file as managed, while preserving an existing root .gitignore as user-owned.
• Existing memory-bank-cli update: creates the new nested ignore file as a non-conflicting managed path, even when the root .gitignore remains user-owned.
• Repeated updates preserve the managed file through the existing ownership lock semantics.

No memory-bank-cli change or coordinated release is required.

Verification

• ruby tools/validate-priming-manifests-test.rb
• ruby tools/validate-priming-manifests.rb template/memory-bank
• memory-bank-cli lint --scope-root template/memory-bank --entrypoint template/memory-bank/README.md
• memory-bank-cli doctor --profile template
• git diff --check origin/main...HEAD
• end-to-end install with memory-bank-cli 1.8.1 into a Git repository with a custom root .gitignore: nested rule created as managed; root file preserved; git check-ignore identifies .start-issue/.gitignore
• end-to-end update from pre-fix origin/main to this branch under the same conditions: nested rule created as managed; root file remains user-owned and unchanged; git check-ignore identifies .start-issue/.gitignore