Move pixad's startup from cmd/pixad into internal/app (closes #206)

cmd/pixad/main.go built the command line and its --config flag, set
PIXA_CONFIG_PATH from that flag, ignored SIGPIPE and started the fx
app. REPO_POLICIES.md now requires cmd/ to hold only one call into
internal/ or pkg/, so that code moves unchanged to Run in the new
internal/app package, and main calls app.Run(Version). Version stays
in main, so the -X main.Version build flags in the Dockerfile and the
Makefile do not change.

Model: opus-5-5

.gitignore

@@ -11,6 +11,12 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
 # Environment / secrets
 .env
 .env.*

TODO.md

@@ -36,6 +36,10 @@ P2: security: per-IP rate limiting on the image routes
   `PIXA_CONFIG_PATH`, ignoring `SIGPIPE`, starting the fx app) is now `Run` in
   `internal/app`, unchanged, and `main` calls it with `Version`, which the build
   still sets through `-X main.Version`. That code had no tests to move.
+- 2026-10-04 `.gitignore` ignores `.claude/` (closes #204): the entry and its
+  comment are copied from the canonical `.gitignore` in `sneak/prompts`,
+  unanchored so it matches at every depth. `.dockerignore` already has
+  `.claude`.
 - 2026-10-04 `.dockerignore` keeps secrets out at every depth (closes #205): the
   file is now the standard one from `sneak/prompts`, whose patterns match in
   every directory and, for environment files and private keys, in any letter