Exclude .claude, .agents and AGENTS.md from git in the new project

After the templates are copied, create-project.sh adds /.claude, /.agents and
/AGENTS.md to .git/info/exclude of the new project as its own step, "Git
excludes". No .gitignore or tracked file changes and nothing is committed.
The step is skipped when the framework steps are skipped, and a path git
already tracks stays tracked and is named in the step.

The .git/info/exclude code of exclude_env_file moves into the shared helper
exclude_from_git (git.sh), which both now use; the .env behavior is unchanged.

Refs #66
Task: MIL-009#2

src/lib/git.sh

@@ -4,7 +4,7 @@
 #
 # Part of create-project.sh: sourced by it, never run on its own.
 #
-# Provides: git_project, fetch_origin
+# Provides: git_project, exclude_from_git, fetch_origin
 
 # git_project DIR ARGS...: run git in DIR. Prompts are switched off and stdin
 # is closed (git must not eat the answers meant for later prompts), so a
@@ -16,6 +16,40 @@ git_project() {
     git -C "$dir" "$@" </dev/null
 }
 
+# exclude_from_git DIR COMMENT ENTRY...: make git ignore each ENTRY in DIR
+# without touching a tracked file: the entries go into .git/info/exclude,
+# which is never committed. An entry that already takes effect (checked by its
+# pattern, so a tracked path counts) is left out, and with none left nothing
+# is written. The comment line goes above the entries that are written. The
+# number of entries written is left in REPLY; the return status is 1 when an
+# entry still does not take effect afterwards.
+exclude_from_git() {
+  local dir="$1" comment="$2" gitdir exclude entry path missing=()
+  shift 2
+  for entry in "$@"; do
+    path="${entry#/}"
+    if ! git_project "$dir" check-ignore --no-index -q -- "${path%/}"; then
+      missing+=("$entry")
+    fi
+  done
+  REPLY="${#missing[@]}"
+  if ((REPLY == 0)); then
+    return 0
+  fi
+  gitdir="$(git_project "$dir" rev-parse --absolute-git-dir)"
+  exclude="$gitdir/info/exclude"
+  mkdir -p -- "$gitdir/info"
+  # Start on a fresh line when the file does not end with one.
+  if [[ -s $exclude && -n "$(tail -c 1 -- "$exclude")" ]]; then
+    printf '\n' >>"$exclude"
+  fi
+  printf '%s\n' "# $comment" "${missing[@]}" >>"$exclude"
+  for entry in "${missing[@]}"; do
+    path="${entry#/}"
+    git_project "$dir" check-ignore --no-index -q -- "${path%/}" || return 1
+  done
+}
+
 # fetch_origin DIR: fetch the Gitea repository into the project. Over SSH the
 # user's key is used. Over HTTPS the token reaches git through a private
 # GIT_ASKPASS helper and the environment of this one command: it is never part