chore(linting): refresh configs and sweep auto-fix

Pull in the refreshed linter and tooling configs (editorconfig,
gitignore, gitattributes, prettierignore, prettierrc, markdownlint,
yamllint, env.example, dotnet-tools) and run prettier and markdownlint
in --fix / --write mode across the repo so the existing tree matches
the new rules.

- prettier 2-space indent on yaml/yml and json overrides, asterisk
  strong, underscore emphasis, proseWrap always
- markdownlint MD007 indent aligned to 2 and MD049 to underscore so
  prettier output stays passing
- preflight Block F also ignores CLAUDE.md (gitignored personal file)
- prettierignore extended to keep HellionChat.yaml manifest and the
  NuGet packages.lock.json out of the formatter

No semantic content changed; csharpier, build, full build-suite
(729/729) and the new prettier/markdownlint/yamllint checks all green.

.gitea/workflows/security.yml

@@ -1,20 +1,20 @@
 name: Security
 on:
-    push:
-        branches: [main, master]
-    pull_request:
-    schedule:
-        - cron: "0 6 * * 1"
-    workflow_dispatch:
+  push:
+    branches: [main, master]
+  pull_request:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
 
 jobs:
-    scan:
-        uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
-        with:
-            # MessageStore.cs uses string-interpolation in CommandText for table
-            # names and clause-joins that come from internal code constants, not
-            # user input. Values are bound via SqlParameter, the SQL surface is
-            # local-only inside a Dalamud plugin. Semgrep matches the pattern
-            # without dataflow, so it flags those eight call sites; CodeQL
-            # would not. Suppressed for this repo only.
-            semgrep-exclude-rules: "csharp.lang.security.sqli.csharp-sqli.csharp-sqli"
+  scan:
+    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
+    with:
+      # MessageStore.cs uses string-interpolation in CommandText for table
+      # names and clause-joins that come from internal code constants, not
+      # user input. Values are bound via SqlParameter, the SQL surface is
+      # local-only inside a Dalamud plugin. Semgrep matches the pattern
+      # without dataflow, so it flags those eight call sites; CodeQL
+      # would not. Suppressed for this repo only.
+      semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'