fix(standardize-repo): scan only non-ignored files for template markers

[evanharmon1]

Summary

verify-applied.sh's "unrendered template markers" check recursively grepped
the whole tree (excluding only .git/node_modules). markdownlint-cli2 isn't the
only tool blind to .gitignore — this grep was too, so an applied iac repo
false-failed on vendored dependencies in gitignored dirs:

FAIL: unrendered template markers found in:
    ./.venv/lib/python3.14/site-packages/ansible/plugins/filter/to_nice_yaml.yml
    ./.venv/.../ansible/galaxy/data/default/role/meta/main.yml.j2
    ...

.venv ships Ansible's own .j2/jinja plugin docs, .terraform caches provider
source. task verify and gitleaks (which respects .gitignore) both pass — only
this structural check tripped.

Fix

Enumerate files the way gitleaks does — honoring .gitignore — via
git ls-files --cached --others --exclude-standard. That covers tracked AND
untracked-but-not-ignored files, so a freshly-rendered, not-yet-staged repo (the
common case right after copier copy, before git add) is still fully checked.
A recursive-grep fallback (with explicit .venv/.terraform/.task/.worktrees/dist
excludes) remains for non-git targets.

This fixes the root cause rather than enumerating individual dirs to skip — any
gitignored path is now correctly out of scope, matching gitleaks.

Test plan

• PASS on a real applied repo (sommerlawn/sommerlawn-infra) that previously
  false-failed. ✅
• Still catches real leaks — regression-tested:
  • untracked file with [[ project_name ]] → caught (validates the --others path)
  • tracked file with {{ author_full_name }} → caught (--cached path)
  • the same leak but gitignored → correctly not flagged (respects .gitignore)
• shellcheck --severity=error --exclude=SC3037 --exclude=SC2148 clean; shfmt -i 4 clean; bash 3.2 portable. ✅

Context

Surfaced applying harmon-init to sommerlawn-infra. Companion to
evanharmon1/harmon-init#84 (the same false-positive hit the template's
lint:markdown glob, fixed there).

🤖 Generated with Claude Code