fix(update): cover every flat-install <db>.db.* artifact, cron stores too, one test module

Fold the dot-suffixed database-artifact class into the existing flat-install
ignore block and test module instead of a second fixture:

- `/*.db.*` now replaces `/*.db.retired-wal-*/` (which it subsumes) and the
  same class rule is added for the cron SQLite stores (`/cron/*.db.*`), so a
  quarantine/repair/rebuild/maintenance/init/dispatch lock, the
  repair-attempts ledger or a malformed-backup copy next to ANY root or cron
  store survives `hermes update`'s `git stash push --include-untracked`.
- The runtime-state list in test_update_flat_install_state_gitignore.py gains
  one representative per artifact producer (hermes_state_dbfile,
  hermes_state_repair, hermes_state_common, hermes_cli/kanban_db_*), and the
  inode/flock invariant from #111667 moves into that module, driving the real
  updater seam `_stash_local_changes_if_needed` rather than a bare `git stash`.

Why: a swept lock pathname is re-created on a new inode and a second
exclusive flock succeeds while the first holder is still live (#112974);
naming one file would leave the sibling locks exposed.

.gitignore

@@ -171,7 +171,11 @@ docs/superpowers/*
 # Flat-install runtime state (checkout root == $HERMES_HOME, e.g. installs made
 # with HERMES_INSTALL_DIR=$HERMES_HOME or by older installers): every root-level
 # SQLite store (state.db, kanban.db, response_store.db, ...) with its
-# WAL/SHM/journal sidecars and retired-WAL capture dirs, the legacy transcripts,
+# WAL/SHM/journal sidecars and every dot-suffixed `<db>.db.*` runtime artifact
+# (retired-WAL capture dirs, quarantine/repair/rebuild/maintenance/init/dispatch
+# lock files, the repair-attempts ledger, malformed-backup copies — a swept lock
+# path is re-created on a new inode and a second exclusive flock succeeds while
+# the first holder is still live, #112974), the legacy transcripts,
 # the cron job store (jobs.json), its lock/heartbeat/output files and all three
 # cron SQLite stores (executions/deliveries/notepad, WAL-mode like the root
 # ones), gateway lock/pid/state files and per-launch markers, cache/spill
@@ -184,11 +188,10 @@ docs/superpowers/*
 # gateway (#110648). Nested installs keep all of this under $HERMES_HOME outside
 # the checkout, where the `.hermes/` rule above already applies.
 /*.db
-/*.db.*
 /*.db-wal
 /*.db-shm
 /*.db-journal
-/*.db.retired-wal-*/
+/*.db.*
 /gateway/discord_message_recovery.db*
 /sessions/
 /browser-profile/
@@ -196,7 +199,7 @@ docs/superpowers/*
 /cron/*.db-wal
 /cron/*.db-shm
 /cron/*.db-journal
-/cron/*.db.retired-wal-*/
+/cron/*.db.*
 /cron/jobs.json
 /cron/.jobs.lock
 /cron/ticker_heartbeat