Tracked `.amp/services.yaml` is matched by `.gitignore`, aborting the pre-commit hook on any merge from main

## Problem / Goal

`.gitignore:101` ignores `.amp`, but #14823 committed `.amp/services.yaml` as a **tracked** file. The two are in direct conflict, and the result is that `git commit` fails for anyone merging `main` into a branch created before #14823.

`git add` refuses to stage a path matching `.gitignore` unless that path is already in `HEAD`. On a branch whose `HEAD` predates #14823, `.amp/services.yaml` arrives as a *new* path via the merge, so:

```
$ git add .amp/services.yaml
The following paths are ignored by one of your .gitignore files:
.amp
hint: Use -f if you really want to add them.
```

`lint-staged` formats the file with oxfmt and then re-stages everything it touched. That `git add` fails, so the **`Applying modifications from tasks` step fails and the whole commit is aborted**:

```
[COMPLETED] pnpm typecheck:website
[COMPLETED] * — 502 files
[STARTED] Applying modifications from tasks...
[FAILED] The following paths are ignored by one of your .gitignore files:
[FAILED] .amp
```

Everything upstream of that — oxfmt, `pnpm lint`, `pnpm typecheck`, `typecheck:browser`, `typecheck:website` — passes first, so you burn the full hook runtime (several minutes on a large merge) before it dies. The error also does not name the commit as the casualty, so it reads like a lint failure rather than a `.gitignore` conflict.

**Reproduction**

```bash
git checkout -b repro
git merge origin/main
git commit --no-edit # fails at "Applying modifications from tasks"
```

## Proposed Solution

A negation alone does not work — `.amp` excludes the directory, and git will not descend into an excluded directory to reconsider files inside it. The pattern has to exclude the *contents* instead:

```gitignore
.amp/*
!.amp/services.yaml
```

If `.amp/services.yaml` was committed by accident and is not meant to be tracked, the alternative fix is `git rm --cached .amp/services.yaml` — but #14823's title ("configure Amp orb development environment") reads like it is intended to be shared, so the negation looks correct.

## Acceptance Criteria

- [ ] `git check-ignore -v .amp/services.yaml` reports no match, while other paths under `.amp/` stay ignored.
- [ ] On a branch whose `HEAD` predates 57812beee6, `git merge origin/main && git commit` completes without `--no-verify`.
- [ ] `git status` stays clean for local-only Amp files (e.g. `.amp/settings.json`) after the change.

## Related

Same family as #14788 — pre-commit-only tooling that CI never exercises, so the breakage surfaces one developer at a time instead of in a pipeline.

Start at .gitignore:101 and review the existing .amp rule alongside the tracked .amp/services.yaml file. Run git check-ignore -v for the shared file and a local-only file, then reproduce the merge and commit from a pre-57812beee6 branch. Done means the shared file is not ignored, other .amp contents remain ignored, and the commit completes with a clean status.

Written by the indexing model from the issue text.