Task: Remove the committed session cookie

The cookie jar is out of the tree and out of the ignore list's reach.

• build/cj.txt is untracked and ignored.
• The session it holds is revoked.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

The curl cookie jar is out of the tree and ignored.

• build/cj.txt was tracked and held a live session token; it is removed and /build/cj.txt is ignored, with the reason stated in .gitignore.
• The token is still in the repository history; the session it holds must be revoked by signing the account out or rotating its password, and a clean history would need a rewrite, which is a separate decision.