Sync .gitignore to canonical with marker-based sections

Author: coenttb

.gitignore

@@ -1,4 +1,9 @@
+# ========== CANONICAL (auto-synced, do not edit) ==========
+# Source: swift-institute
+# Sync: Scripts/sync-gitignore.sh or manual
+
 *~
+.DS_Store
 
 Package.resolved
 DerivedData/
@@ -12,6 +17,16 @@ Thumbs.db
 !/.swift-format
 !/.swiftformat
 !/.swiftlint.yml
+!/.swiftlint/
+
+# Top-level entries (opt-in only)
+# First ignore all, then whitelist specific folders and files
+/*
+!/Sources/
+!/Tests/
+!/.github/
+!/Package.swift
+!/LICENSE.md
 
 # Documentation (opt-in for whitelisted .md files and .docc catalogs only)
 # Blocks all .md files by default to prevent AI-generated content from being committed
@@ -24,7 +39,16 @@ Thumbs.db
 !SECURITY.md
 !**/*.docc/**/*.md
 
+*.pdf
+
+# SwiftLint
+**/.swiftlint/RemoteConfigCache
 
-# SwiftLint Remote Config Cache
-.swiftlint/RemoteConfigCache
+# Swift Package Manager
 .build/
+.swiftpm/
+
+# ========== END CANONICAL ==========
+
+# ========== LOCAL OVERRIDES ==========
+# Package-specific rules below (preserved during sync)