feat: ADR-0006 §8 step 6 — .snapshots/ gitignore + export + cleanup

The undo ring is local working state, handled at all three
project-file seams (R13):
- .gitignore template ignores /.snapshots/
- export excludes .snapshots/ (like playground.db / history.log)
- safely_delete_temp_project allowlists .snapshots/ so a temp that
  was modified then undone back to empty stays auto-deletable
- undo::SNAPSHOTS_DIR is now a pub const referenced by all three
- tests: gitignore content, export exclusion, cleanup allowlist

1693 passed / 0 failed / 1 ignored; clippy clean.

src/archive.rs

@@ -43,6 +43,9 @@ const EXPORT_EXCLUDED_NAMES: &[&str] = &[
     PLAYGROUND_DB,
     HISTORY_LOG,
     ".rdbms-playground.lock",
+    // Undo snapshot ring (ADR-0006 Amendment 1): local working
+    // state, never shared.
+    crate::undo::SNAPSHOTS_DIR,
 ];
 
 /// Maximum auto-suffix attempts when resolving a colliding
@@ -306,6 +309,7 @@ fn add_directory_recursive(
 /// - `playground.db` (always derived; ADR-0007 / ADR-0015 §11)
 /// - `history.log` (ADR-0007 amendment 1: user-private)
 /// - `.rdbms-playground.lock` (per-process)
+/// - `.snapshots/` (undo ring; local working state, ADR-0006 Am. 1)
 /// - `*.tmp` (atomic-write staging files)
 /// - `project.yaml.v*.bak` (migration backups; recipient
 ///   doesn't need our local recovery aids)
@@ -524,6 +528,18 @@ mod tests {
         fs::write(p.join(GITIGNORE), "/playground.db\n").unwrap();
         // Stray atomic-write staging file — must be excluded.
         fs::write(p.join("project.yaml.tmp"), "stale").unwrap();
+        // Undo snapshot ring — local working state, must be excluded.
+        fs::create_dir_all(p.join(crate::undo::SNAPSHOTS_DIR).join("0")).unwrap();
+        fs::write(
+            p.join(crate::undo::SNAPSHOTS_DIR).join("index.yaml"),
+            "next_id: 1\nundo: []\nredo: []\n",
+        )
+        .unwrap();
+        fs::write(
+            p.join(crate::undo::SNAPSHOTS_DIR).join("0").join(PLAYGROUND_DB),
+            [0u8; 16],
+        )
+        .unwrap();
         p
     }
 
@@ -548,6 +564,11 @@ mod tests {
         assert!(!names.iter().any(|n| n.contains("history.log")));
         assert!(!names.iter().any(|n| n.contains(".lock")));
         assert!(!names.iter().any(|n| n.ends_with(".tmp")));
+        // Undo snapshot ring is local working state — never shared.
+        assert!(
+            !names.iter().any(|n| n.contains(".snapshots")),
+            "snapshots leaked into export: {names:?}"
+        );
         // .gitignore IS included (sensible default for the recipient).
         assert!(names.iter().any(|n| n == "MyProject/.gitignore"));
     }