fix: untrack the node_modules symlinks + lint so it cannot recur (#491)

[agentfleets]

Closes #491.

What happened

cf7eb93e accidentally committed two symlinks (mode 120000) pointing at an absolute scratch path:

• desktop/node_modules → /tmp/claude-1000/.../scratchpad/vaultfix-wt/desktop/node_modules
• desktop/electron/node_modules → same layout under desktop/electron/

A tracked entry at a node_modules path bypasses the ignore rules, and the blast radius was observed on two machines' checkouts: git pull replaced populated node_modules directories with the dangling symlink (dependency installs silently destroyed, npm run build then fails on missing packages), and worktrees holding a real node_modules directory could not check out main at all.

Fix

• git rm desktop/node_modules desktop/electron/node_modules — the two symlink blobs, no other content at those paths.
• scripts/lint-no-tracked-node-modules.sh — hard ban (not a ratchet): any tracked path containing a node_modules segment fails, with the offending paths listed. Wired into the lint job in ci.yml, matching the existing lint-*.sh conventions.

Verification

• Lint fails on current main (exit 1, lists both symlinks) — tested by running the script from the main checkout.
• Lint passes with this branch (exit 0).
• Both checkouts had deps reinstalled via npm ci and the desktop + electron builds and installer packaging were re-verified green on cf7eb93e after recovery.

Note for merge: after this lands, anyone who pulled cf7eb93e should rm -f desktop/node_modules desktop/electron/node_modules before/after pulling (the tracked symlinks get deleted by the merge; a dangling symlink left untracked would still shadow npm ci) and re-run npm ci in both packages if they haven't already.