Housekeeping: gitignore, and finish the webhook-Secret-loss/RBAC fix

- Add .gitignore (build artifacts, editor swapfiles, envtest testbin).
- Remove the stray .DESIGN.md.swp that was sitting untracked in the repo.
- Carries the DESIGN.md §5/§9/§13 edits from the secret-loss discussion:
  fail-closed (not self-healed) TerdutAlertSource webhook Secret loss, and
  the corrected RBAC section (the webhook Secret lives in the CR's tenant
  namespace, not the operator's own namespace as an earlier draft claimed).

.gitignore

@@ -0,0 +1,14 @@
+# Go build artifacts
+bin/
+*.exe
+
+# editor swapfiles
+*.swp
+*.swo
+*~
+
+# envtest binaries downloaded by setup-envtest
+/testbin/
+
+# local kubeconfig/secrets some workflows write here
+*.kubeconfig