chore(config): add scipy + Pillow deps, gitignore terrain/spike data

scipy 1.17.1 and Pillow 12.2.0 — both CVE-audited clean against
NVD + OSV (2026-04-06). Required by planet generator pipeline.
Gitignore generated terrain.npz, spike intermediates, and tmp files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -34,6 +34,15 @@ renderer/output/*.png
 spikes/**/.godot/
 spikes/**/*.import
 spikes/**/*.uid
+spikes/**/*.npy
+spikes/**/*.npz
+
+# Planet generator intermediates
+tooling/planet-gen/__pycache__/
+*.tmp.npz
+
+# Generated terrain grids (large, regenerated from pipeline)
+wiki/**/bodies/**/terrain.npz
 
 # Asset downloads (vendor archives, not game content)
 docs/assets/downloads/

pyproject.toml

@@ -6,6 +6,11 @@ dependencies = [
     "PyYAML",
     "jsonschema",
     "numpy",
+    # scipy 1.17.1 — checked clean against NVD + OSV, no CVEs on record (2026-04-06)
+    "scipy==1.17.1",
+    # Pillow 12.2.0 — checked clean against NVD + OSV (2026-04-06)
+    # CVE-2026-25990 fixed in 12.1.1, CVE-2025-48379 fixed in 11.3.0
+    "Pillow==12.2.0",
 ]
 
 [project.optional-dependencies]