Keep buck2's output tree out of the flake's source

buck-out/ was swept into 1e8b590, and .gitignore never named it. The
flake's source is the git tree, so every build shipped 263 MiB to
eu.nixbuild.net — two 37M APKs, the boot image three times over, both
copies of libvidya.so — which is to say it sent the remote builder the
outputs it was being asked to produce.

The tree stays on disk; only the index and the ignore file change. The
blobs remain in history, so this shrinks what a build copies, not what a
clone fetches.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>