Harden generated artefact boundaries and stop tracking exported inventory packages

[Copilot]

This change closes gaps in the repository’s generated-artifact boundary so local databases, cloned spec corpora, SARIF/results, inventory exports, and packaged shard outputs are not accidentally committed. It also aligns the repo’s cARL/docs guidance with the actual ownership model for those artifacts.

• Ignore generated inventory outputs more completely

  • Extend inventory/ ignores beyond JSON exports to also cover shard directories and packaged ZIP outputs.
  • Keep inventory/.gitkeep as the only tracked placeholder in that directory.

  inventory/*.json
  inventory/*.min.json
  inventory/shards/
  inventory/*.zip

• Document artifact ownership in .gitignore

  • Add targeted comments that tie each generated area to the script or workflow that owns it:
    • results/ → query execution / security scan workflow
    • azure-rest-api-specs/ → refresh/export inputs
    • database/ → refresh/build pipeline
    • inventory/ → export workflows
  • Add local-only Python cache and virtualenv artifacts that should never be committed.

• Remove tracked generated exports

  • Drop previously tracked generated inventory ZIPs from inventory/ so the ignore rules are effective in practice, not just in theory.

• Reconcile contributor and cARL guidance

  • Update contributor guidance and durable cARL memory to reflect the canonical rule: generated inventory exports are untracked outputs, not repository content.
  • Update the active PR contract so the repository boundary change is explicitly governed.