pkgs/launcher: a 16 MB compiled binary is tracked in git, and no pkgs Go module's build output is gitignored #353

Problem

pkgs/launcher/launcher is a compiled binary tracked in git, and no pkgs/ Go module's local build output is covered by .gitignore (except identity), so building these modules dirties the working tree — and in launcher's case overwrites a tracked 16 MB artifact.

Evidence (verified on main 0fccf414)

• git ls-tree shows pkgs/launcher/launcher as a tracked blob of 16,351,700 bytes: ELF 64-bit LSB executable, x86-64, Go BuildID=..., with debug_info, not stripped. It was committed in ef6759b4 / 493f2244 and nothing in the tree references the path (repo-wide grep for launcher/launcher / ./launcher outside the file itself: no hits). The source is pkgs/launcher/main.go; the binary is pure build output.
• Reproduced the hazard: in a clean worktree of main, go build . inside pkgs/launcher changes the file's md5 (7c1922c6… → 78605330…) and git status reports M pkgs/launcher/launcher. The long-lived dev clone already shows exactly this modification, plus untracked pkgs/chat/chat, pkgs/database/database, pkgs/import/import from local builds.
• git check-ignore on each module's natural build output (go build in the module dir writes an executable named after the directory): only pkgs/identity/identity is ignored (via pkgs/identity/.gitignore:19). chat, database, graph, import, launcher, map, tea outputs are not ignored.
• Since CI: five pkgs Go modules (chat, database, import, launcher, tea) are built by nothing — the map/identity rot pattern, still unguarded #342/ci: build and vet the five uncovered pkgs Go modules (#342) #343 these modules are built routinely (go-modules-build.yml, map-build.yml, identity-build.yml run go build ./... in CI, which discards output — but the natural local command go build / go build . writes the binary into the module directory), so the noise recurs for every contributor, and a careless git add -A re-commits a fresh 16 MB binary.

Why it matters

• 16 MB of binary bloat in every clone, for an artifact anyone can rebuild from main.go in seconds.
• A tracked build artifact that silently changes on every local build invites accidental recommit of a stale/platform-specific binary and creates phantom diffs in unrelated work (already observed in the dev clone).
• Untracked build outputs for the other seven modules pollute git status and risk the same accidental commit.

Suggested fix / acceptance criteria

• pkgs/launcher/launcher is no longer tracked (git ls-files pkgs/launcher/launcher is empty); the module still builds from source.
• For every Go module under pkgs/ with a root package main (chat, database, graph, identity, import, launcher, map, tea), git check-ignore pkgs/<module>/<module> succeeds — e.g. a /name entry in the module's own .gitignore, following the existing precedents (pkgs/identity/.gitignore's identity entry; the /gomod2nix-template anchored style in sibling modules). Modules without a .gitignore (chat, database, tea) gain one.
• After running go build . in each of those modules, git status --porcelain is clean.
• No source or CI changes are needed; go-modules-build / map-build / identity-build stay green.

Single-repo: the pkgs/ Go modules exist only in this repo.