chore(config): add scipy + Pillow deps, gitignore terrain/spike data

scipy 1.17.1 and Pillow 12.2.0 — both CVE-audited clean against
NVD + OSV (2026-04-06). Required by planet generator pipeline.
Gitignore generated terrain.npz, spike intermediates, and tmp files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pyproject.toml

@@ -6,6 +6,11 @@ dependencies = [
     "PyYAML",
     "jsonschema",
     "numpy",
+    # scipy 1.17.1 — checked clean against NVD + OSV, no CVEs on record (2026-04-06)
+    "scipy==1.17.1",
+    # Pillow 12.2.0 — checked clean against NVD + OSV (2026-04-06)
+    # CVE-2026-25990 fixed in 12.1.1, CVE-2025-48379 fixed in 11.3.0
+    "Pillow==12.2.0",
 ]
 
 [project.optional-dependencies]