Remove embedded git repos; ignore vendored data dirs

applepy/data/lynis and applepy/data/macos_security were committed as
gitlink stubs (mode 160000) because rsync -a copies .git/ along with
everything else. Cloners would silently receive empty directories.

Fix: remove the submodule stubs, add both dirs to .gitignore (they are
populated by scripts/vendor_compliance_assets.sh), and add --exclude .git
to both rsync invocations so future vendor runs don't recreate the problem.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -25,6 +25,10 @@ out-priv/
 # Reference material (large PDFs + nested repos, not needed to run the tool)
 pdfs/
 
+# Vendored third-party assets (populate with scripts/vendor_compliance_assets.sh)
+applepy/data/lynis/
+applepy/data/macos_security/
+
 # Personal / session notes
 progress.txt
 resume.txt

scripts/vendor_compliance_assets.sh

@@ -20,7 +20,7 @@ clone_mscp() {
   mkdir -p "${MACP}"
   git clone --depth 1 "https://github.com/usnistgov/macos_security.git" "${TMP}/macos_security"
   rsync -a --delete \
-    --exclude README.md --exclude .gitignore \
+    --exclude README.md --exclude .gitignore --exclude .git \
     "${TMP}/macos_security/" "${MACP}/"
   echo "Vendored macos_security -> ${MACP}"
 }
@@ -33,7 +33,7 @@ clone_lynis() {
   mkdir -p "${LYNP}"
   git clone --depth 1 "https://github.com/cisofy/lynis.git" "${TMP}/lynis"
   rsync -a --delete \
-    --exclude README.md --exclude .gitignore \
+    --exclude README.md --exclude .gitignore --exclude .git \
     "${TMP}/lynis/" "${LYNP}/"
   echo "Vendored Lynis -> ${LYNP}"
 }