fix(ci): untrack .venv symlink and align Beam avatar contract

The staging gate failed on READ_ERROR .venv after a docs commit tracked a
symlink that gitignore .venv/ does not ignore. CI replaces that path with a
real venv directory. Drop the symlink, ignore the name itself, and lock it
in the privacy scan. Also point the Beam avatar source contract at the
current profile-panel copy so npm test stops failing after Python.

.gitignore

@@ -33,8 +33,10 @@ benchmarks/jyotish/outputs/
 output_report.txt
 results_extracted.md
 runtime-smoke-report-*.html
-# Local Python runtime for the API server
-.venv/
+# Local Python runtime for the API server.
+# No trailing slash: `.venv/` ignores only directories, so a symlink of the
+# same name stayed tracked and CI overwrote it with a real venv (BUG-974).
+.venv
 # Local Supabase CLI link/cache state
 supabase/.temp/
 # Local review artifacts and unused package-manager state