fix(privacy): ignore scraper state and interview records at any depth (#208)

job_scraper/seen_jobs.json (and notion_sync.json / *.md) were ignored by a repo-rooted pattern, but the job-scraper skill resolves job_scraper/ relative to its own directory, so the state file lands at .claude/skills/job-scraper/job_scraper/ and the rule never matched - publishing every scraped posting with fit scores and skip-reasons on a public fork. Switches to **/-prefixed patterns that match at any depth (the rooted location still matches too, so no regression), and adds documents/interview/** (interview prep names employers, quotes submitted material, and lists the candidate's weak points) - it was never ignored though documents/applications/** was. REQUIRED_IGNORE_RULES updated in lockstep so the security guard stays in sync.

By @LeoWinston-9596 (split from #199). Verified: both nested and root seen_jobs.json now ignored, interview records ignored, guard suite green (17 tests incl. #195's negation checks). Rebased cleanly on current master.

.gitignore

@@ -20,9 +20,12 @@ venv/
 
 # Personal data (never commit these)
 salary_data.json
-job_scraper/seen_jobs.json
-job_scraper/notion_sync.json
-job_scraper/*.md
+# Match at any depth: the job-scraper skill resolves `job_scraper/` relative to
+# its own directory, so these land at .claude/skills/job-scraper/job_scraper/*.
+# A rooted `job_scraper/...` pattern silently fails to match them.
+**/job_scraper/seen_jobs.json
+**/job_scraper/notion_sync.json
+**/job_scraper/*.md
 *_BehavioralReport.pdf
 linkedin_Profile.pdf
 
@@ -61,6 +64,9 @@ documents/diplomas/**
 documents/references/**
 documents/applications/**
 documents/postings/**
+# Interview prep and experience records: these name the employers applied to,
+# quote what was submitted, and set out the candidate's weak points.
+documents/interview/**
 !documents/**/.gitkeep
 
 # Personal job search tracking