Keep runtime state local

.forest/HEAD, checkout local.yaml, and checkout sync_state.json are user-local runtime state and should be ignored by git. Shared forest metadata lives in checkout forest.yaml; cloned users initialize their own active checkout, local path bindings, active remote, and sync state.

Amendment (Grilling Round 2)

gitignore does not stop Dropbox: these files are git-invisible but Dropbox-synced across machines with no merge ((conflicted copy) files already exist in this tree). "User-local" therefore holds only under the v1 single-active-machine assumption (ADR-0009). Two consequences: (1) the gitignore rewrite uses a surgical replace of forest-owned blanket ignores plus a git check-ignore assertion, not a !-negation whitelist, so HEAD/local.yaml/sync_state.json are never accidentally committed; (2) intra-machine write races (Snakemake, shell &) are guarded by a per-checkout flock on push/pull, not by mtime comparison.