chore: keep release checkouts free of build output and dev automation

Release packaging walked a working tree that still carried .NET build
output, Playwright run artifacts, and one-off browser automation scripts.
Those files are not source, could not be reproduced from the commit, and
made a clean-tree release gate impossible.

Build output and test run directories are now ignored and untracked, and
developer-only automation/scratch material moved under a single ignored
`scripts/local/` directory. A stale admin bundle that no HTML referenced
was dropped from the API server web root.

.gitignore

@@ -18,6 +18,7 @@ release/
 !/release/product-version.json
 !/release/android-release-identity.json
 !/release/mobile-release-evidence-public.pem
+!/release/update-policy.json
 *.unpacked
 /.ci-tools/
 
@@ -81,3 +82,39 @@ apps/mobile-rn/.maestro/*.junit.xml
 /scripts/playwright-live-ad-portals-signup.js
 /scripts/playwright-submit-applovin.js
 /scripts/register-and-inspect-ad-portals.js
+
+# Local-only automation, scratch captures, and one-off dev helpers.
+# `scripts/local/` keeps them out of the release checkout while remaining runnable locally.
+/scripts/local/
+/junk/
+/scratch/
+*.st.txt
+/launch-debug-chrome.bat
+/open-oauth.bat
+/run-admob-login.bat
+/*-boundary.png
+/apps/mobile-rn/*-boundary.png
+/docs/v3/play/assets/screenshots/
+
+# .NET build output
+apps/api-server/bin/
+apps/api-server/obj/
+apps/api-server.Tests/bin/
+apps/api-server.Tests/obj/
+
+# Playwright run output
+test-results/
+apps/web/test-results/
+apps/web/playwright-report/
+apps/desktop/test-results/
+
+# Supabase CLI local state
+/supabase/.branches/
+/supabase/.temp/
+
+# Release binaries are not committed: the canonical distribution channel is the
+# Forgejo update feed, and none of these trees are part of a build graph.
+# Historical 1.0.0 copies stay tracked until they are retired.
+/site/public/releases/*/
+/apps/web/public/releases/*/
+/apps/api-server/wwwroot/releases/*/