fix(ci): untrack .venv symlink and align Beam avatar contract

The staging gate failed on READ_ERROR .venv after a docs commit tracked a
symlink that gitignore .venv/ does not ignore. CI replaces that path with a
real venv directory. Drop the symlink, ignore the name itself, and lock it
in the privacy scan. Also point the Beam avatar source contract at the
current profile-panel copy so npm test stops failing after Python.

tests/test_repo_privacy_markers.py

@@ -490,6 +490,16 @@ def test_optional_local_markers_are_additive_and_not_values_in_logs() -> None:
     assert "lines=1" in report and "lines=2" in report
 
 
+def test_local_python_venv_is_not_tracked() -> None:
+    paths = tracked_paths(ROOT)
+    assert ".venv" not in paths
+    assert not any(path.startswith(".venv/") for path in paths)
+
+
+def test_gitignore_covers_venv_symlink_name() -> None:
+    assert _git(ROOT, "check-ignore", "--no-index", ".venv").decode("utf8").strip() == ".venv"
+
+
 def test_git_enumeration_is_nul_delimited_and_status_first(monkeypatch: pytest.MonkeyPatch) -> None:
     calls = []
     def run(argv, **kwargs):