gitignore: anchor the controller entry so it stops matching cmd/controller/

A bare 'controller' matches directories too, so rg silently skipped
cmd/controller/main.go (false no-caller readings) and new files there needed
git add -f. /controller still ignores the built binary.

controller/.gitignore

@@ -4,8 +4,13 @@ bin/
 *.dll
 *.so
 *.dylib
-controller
-controller.exe
+# ANCHORED (leading slash) on purpose: a bare `controller` also matches the DIRECTORY
+# cmd/controller/, so ripgrep silently skipped main.go and new files there needed `git add -f`.
+# Both directions produce inert-seam mistakes — a grep for a setter finds no caller and reads as
+# "this is unused", and a genuinely-new file never gets committed. Only the built binary at the
+# module root should be ignored here.
+/controller
+/controller.exe
 
 # Test artifacts
 coverage.out