Server: keep pasted files out of git status #1627

Problem

Images and files pasted into a pane are saved in a default attachment directory under the working directory. When that's a Git repository, every paste shows up in git status as an untracked file, and it's easy to commit by accident.

Proposal

• In server/paste.ts, right after savePaneImage creates the default attachment directory, create a .gitignore there containing just *.
• Create it with an exclusive write (wx, mode 0600) and ignore only "already exists". Other errors surface. No check-then-write.
• Do this only when HERDR_WEB_PASTE_DIR is unset or blank, using the same default and trim rule as pasteDirectory, including its fallback when there's no working directory.
• Saved paths stay readable through locateFile and the explicit path given to the agent. Ignored doesn't mean unreadable.

What not to copy or do

• Never write an ignore file into a directory the user chose, even if its path matches the default.
• Never replace or follow an existing .gitignore, including a symlink or one with custom rules.
• Don't touch the repository's root ignore or Git config, and don't add cleanup, TTL or a setting.

Done when

• Pasting into a pane whose working directory is a Git repository leaves git status clean, and the agent can still open the file by its returned path.
• Concurrent pastes produce one .gitignore and no errors.
• An existing .gitignore in that directory is left byte-for-byte unchanged, and a custom HERDR_WEB_PASTE_DIR gets no ignore file.

Current state

• Work exists on the local branch fix/default-paste-gitignore (not pushed) with 1 commit. It was independently reviewed and needs fixes, none of them shown to be in the change itself:
• The fast check suite and the full browser regression didn't pass, because of existing flaky or timing-dependent tests (installer timing, process startup timeouts, a stalled file upload step, fixed sleeps).
• A contract test depends on the shared temporary directory and fails on main too; it needs its own temporary directory before the gates can be called green.

Part of #1053.