feat(scripts): add merge-to-production script for content-only workflow

- Add merge-to-production.sh to merge dev to production (content only)
- Script removes non-content files (config, scripts, docs, Docker)
- Production branch contains ONLY: pages, themes, content plugins
- Updated .gitignore to exclude sensitive and dev-only files
- Exclude security.yaml (salt) from being tracked
- Exclude vendor directories (can be installed via GPM)
- Exclude Docker, nginx, PHP configs (production content only)
- Exclude scripts and documentation (production content only)
- Exclude git hooks (local only)

Production Branch Strategy:
- Dev: Full repository (config, content, scripts, docs)
- Production: Content only (pages, themes, plugins)
- Merge: Automated via script removes non-content
- Security: Sensitive configs stay in dev

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

.gitignore

@@ -10,3 +10,36 @@ config/www/user/backup/
 
 # .crush directory
 .crush/
+
+# Sensitive configuration (salt for password hashing)
+config/www/user/config/security.yaml
+
+# Docker and nginx configuration (production only needs content)
+config/nginx/
+config/php/
+
+# Scripts (production only needs content)
+sync.sh
+deploy-production.sh
+merge-to-production.sh
+
+# Git hooks (local only)
+.git/hooks/
+
+# Documentation (production only needs content)
+AGENTS.md
+BUSINESS-RULES.md
+DEPLOYMENT.md
+GIT-SYNC.md
+WORKFLOW.md
+BRANCHES.md
+
+# README (production has PRODUCTION.md)
+README.md
+
+# Vendor directories (can be installed via GPM)
+config/www/user/plugins/*/vendor/
+
+# Development-only files
+docker-compose.yml
+.dockerignore