fix(security): gitignore /upskill reports at the path the skill writes them (#317)

The upskill/*.md rule is rooted, but /upskill is a skill and skills
resolve bare relative paths against their own directory - the same
observed behavior the **/job_scraper rules exist for. A report at
.claude/skills/upskill/upskill/report-*.md was not ignored, and an
upskill report records the candidate's skill gaps against named
employers. **/upskill/*.md would also ignore the skill's own SKILL.md
(the directory shares the name), so the new rule pins the report-file
prefix: **/upskill/report-*.md. Added to .gitignore and
REQUIRED_IGNORE_RULES, with a check-ignore-based test pinning both
properties.

.gitignore

@@ -89,8 +89,14 @@ gmail_sync/
 # Generated reports (personal output from /html-report)
 reports/
 
-# Upskill reports (personal output)
+# Upskill reports (personal output). Depth-independent like the job_scraper
+# rules above: the upskill skill resolves `upskill/` relative to its own
+# directory, so a report can land at .claude/skills/upskill/upskill/*.md
+# where the rooted rule cannot see it. `**/upskill/*.md` is not usable here -
+# the skill directory shares the `upskill` name, so it would also ignore the
+# skill's own SKILL.md - hence the report-file prefix is pinned instead.
 upskill/*.md
+**/upskill/report-*.md
 
 # Agent skills: track the source, ignore only deps and logs.
 # (A blanket `.agents/` ignore silently drops the job-search CLI skills from the repo.)