Layer 1: Pre-commit hook (scripts/check_no_binaries.sh) blocks 60+
binary/image extensions with .binary-allowlist for build-essential exceptions.
Layer 2: Comprehensive .gitignore binary patterns with ! overrides
for allowlisted files (app icons).
Layer 3: Agent exclusions - .copilotignore, files.exclude, and
search.exclude all mirror the same patterns to prevent Copilot
from hitting the 20-image URL limit.
