feat(tools): add Twenty CRM sync scripts and update .gitignore rules

tools/security_guards.py

@@ -45,13 +45,18 @@ ALLOWED_PERMISSIONS = {
 }
 
 # Personal-data ignore rules that must never disappear from .gitignore.
+# Fork policy: documents/ (cv, linkedin, diplomas, references, postings,
+# sources) is deliberately tracked in git - this repo is a personal fork,
+# not the upstream template. Only generated/derived personal state and
+# secrets stay ignored.
 REQUIRED_IGNORE_RULES = [
     "salary_data.json",
     # Depth-independent: the job-scraper skill resolves `job_scraper/` relative
     # to its own directory, so the state file lands under .claude/skills/... and
     # a repo-rooted rule silently fails to match it.
     "**/job_scraper/seen_jobs.json",
-    "**/job_scraper/notion_sync.json",
+    "**/job_scraper/twenty_sync.json",
+    "**/job_scraper/context_sync.json",
     "**/job_scraper/*.md",
     "*_BehavioralReport.pdf",
     "linkedin_Profile.pdf",
@@ -62,15 +67,9 @@ REQUIRED_IGNORE_RULES = [
     "cover_letters/cover_*.*",
     # /apply also recognizes the uppercase Cover_* naming variant.
     "cover_letters/Cover_*.*",
-    "documents/cv/**",
-    "documents/linkedin/**",
-    "documents/diplomas/**",
-    "documents/references/**",
     "documents/applications/**",
-    "documents/postings/**",
     "documents/interview/**",
     "job_search_tracker.csv",
-    "gmail_sync/",
     "reports/",
     "upskill/*.md",
     # Depth-independent twin of the rule above. The upskill *skill* resolves