Add company-notes protection to git/GitHub MCP servers

## Problem

Company-specific notes can bypass gitignore when using explicit paths:

```bash
git add company-notes/config.sh # bypasses gitignore
```

This could theoretically happen with any `*-notes/` directory (e.g., flywire-notes, client-notes, etc.).

## Solution

Add validation to git and GitHub MCP servers to block `*-notes/*` operations.

- Git MCP: Block `git_add` on company-notes patterns
- GitHub MCP: Block pushes containing company-notes files
- Error: "Cannot commit *-notes/ files (no-leaks principle)"

Simple security improvement to prevent accidental company data exposure.

May create sub-issues for implementation.

No file or test paths are named. Locate the Git MCP git_add handler and the GitHub MCP push path, then trace how explicit paths and pushed files are validated. Done means both servers block *-notes/ files and return the specified no-leaks error.

Written by the indexing model from the issue text.