feat: add gitignore-scrub to catch tracked files newly matched by .gitignore

Standalone function, not gi-private: default mode prompts once for all
tracked-but-ignored files and offers git rm --cached, remembering a
decline per-path in the repo's local git config (gitignore-scrub.skip)
so the same file isn't re-asked. -w/--warn is read-only (prints Warning
lines, no prompt, no mutation) for non-interactive callers like a git
hook. Skips silently above $GITIGNORE_SCRUB_LIMIT tracked files (default
5000) to avoid latency on huge repos.

gi now calls gitignore-scrub at the end of any run that touched
.gitignore.

functions/gi.fish

@@ -5,7 +5,7 @@
 #   04-git-and-version-control
 #
 # DEPENDENCIES
-#   curl, md5sum, md5
+#   curl, md5sum, md5, gitignore-scrub
 #
 # CLASSIFICATION
 #   self-limiting(grep,cat), network, blocking-prompt
@@ -167,6 +167,7 @@ function gi --description 'Generate .gitignore files using the gitignore.io API'
         else
             echo (set_color brblack)"No patterns selected. Skipping API fetch."(set_color normal)
         end
+        test $needs_git -eq 1; and gitignore-scrub
         return 0
     end
 
@@ -196,6 +197,8 @@ function gi --description 'Generate .gitignore files using the gitignore.io API'
             end
         end
     end
+
+    test $needs_git -eq 1; and gitignore-scrub
 end
 
 # SYNOPSIS