housekeeping: gitignore bare fetcher caches, root placeholder, prefix toolchain tarballs

- /*.git/         : bare git fetch caches at root only (e.g. netutils.git/,
                    relibc.git/, syscall.git/ — cookbook transient scratch space)
- /relibc         : empty 0-byte placeholder file at root (artifact of the
                    reverted 'phase 1.1' submodule gitlink refresh — commit
                    b062cf43b7); the real relibc lives at local/sources/relibc/
- /prefix/**/*.tar.gz : downloaded toolchain installer tarballs (clang, gcc,
                    rust). Reproducible via build-redbear.sh.

Anchored patterns (leading /) so they don't accidentally match nested paths.
These gitignore entries affect future fetch behavior only — they do not
untrack anything that's already committed. The untrack step happens in
the next two commits.

.gitignore

@@ -74,3 +74,20 @@ sources/x86_64-unknown-redox/
 sources/*.tar.gz
 Packages/*.pkgar
 .slim/deepwork/
+
+# Bare git fetcher caches at the repo root. The cookbook's fetch workflow
+# creates these as transient scratch space (shallow clones used during
+# recipe source acquisition). Not declared submodules — see .gitmodules
+# for the canonical 9 `submodule/<component>` entries. Anchored to root
+# only; does NOT match nested `.git` directories inside submodules.
+/*.git/
+
+# Empty placeholder file at the repo root. Was an artifact of a reverted
+# "phase 1.1: refresh gitlink SHAs for 9 submodules" attempt — see commit
+# b062cf43b7. The real relibc lives at local/sources/relibc/ (a submodule).
+/relibc
+
+# Downloaded toolchain installer tarballs under prefix/. Reproducible
+# from build-redbear.sh — never commit them. The toolchain is rebuilt by
+# `make prefix` after fork (relibc/kernel/base) changes.
+/prefix/**/*.tar.gz