chore: untrack committed PR infographics and enforce the rule in CI

PR infographics belong in the PR description, referenced from the
image-provider URL. The binary never enters git history.

This rule has been established twice and leaked twice. #48261 removed the
first batch. #54564 removed a second batch and added `infographic/` to
.gitignore — but .gitignore only stops an accidental `git add`. It does
nothing against `git add -f`, and nothing for a directory that does not
literally match the pattern. In the four weeks after that rule landed,
nine more PNGs were force-added, and an `infograficos/` directory
(#70552's loophole, never actually closed) slipped a tenth past the
pattern entirely.

Removes 11 tracked images (~14MB) with `git rm --cached`, so local copies
survive. Adds an infographic-check CI job that matches on the IMAGE rather
than on one directory spelling, so a localized or typo'd path cannot
sidestep it, and extends the .gitignore pattern list as the first line of
defence.

Verified the guard both ways against synthetic repos: it fires on
`git add -f` into `infographic/`, on the `infograficos/` spelling, and on
nested `docs/pr/infographics/*.jpg`; it does not fire on legitimate
product imagery under `docs/assets/` or `website/`, nor on non-image
files.

.gitignore

@@ -175,5 +175,13 @@ apps/desktop/demo/
 # image-provider (fal.media) URL — they are NEVER committed to the repo. The
 # PR body is the archive. See the hermes-agent-dev skill's
 # pr-infographic-workflow reference (storage rule + lapse #8 / #COMMIT-1).
+#
+# Spelling variants are listed because a single `infographic/` pattern was
+# sidestepped by an `infograficos/` directory (#70552). .gitignore is only
+# the first line of defence and cannot stop `git add -f` at all — the
+# infographic-check CI job is what actually enforces this.
 infographic/
+infographics/
+infograficos/
+infografico/
 native/fts5_cjk/*.so