fix(security): gitignore /upskill reports at the path the skill writes them (#317)

The upskill/*.md rule is rooted, but /upskill is a skill and skills
resolve bare relative paths against their own directory - the same
observed behavior the **/job_scraper rules exist for. A report at
.claude/skills/upskill/upskill/report-*.md was not ignored, and an
upskill report records the candidate's skill gaps against named
employers. **/upskill/*.md would also ignore the skill's own SKILL.md
(the directory shares the name), so the new rule pins the report-file
prefix: **/upskill/report-*.md. Added to .gitignore and
REQUIRED_IGNORE_RULES, with a check-ignore-based test pinning both
properties.

tools/security_guards.py

@@ -73,6 +73,13 @@ REQUIRED_IGNORE_RULES = [
     "gmail_sync/",
     "reports/",
     "upskill/*.md",
+    # Depth-independent twin of the rule above. The upskill *skill* resolves
+    # `upskill/` relative to its own directory - the same observed behavior
+    # the **/job_scraper rules exist for - so reports can land at
+    # .claude/skills/upskill/upskill/*.md where the rooted rule cannot see
+    # them. `**/upskill/*.md` would also ignore the skill's own SKILL.md
+    # (the directory shares the name), so the report-file prefix is pinned.
+    "**/upskill/report-*.md",
     # Not personal data but the same failure mode: /add-portal can generate a
     # skill for a portal that only returns usable content through a paid
     # fetching service, and that skill reads an API token from the environment.