Mention un-skip option in docs

[gandie]

What does this PR do?

Short update of .cbmignore docs to make unskip option more discoverable.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test) -> skipped, only docs
• Lint passes (make -f Makefile.cbm lint-ci) -> skipped, only docs
• New behavior is covered by a test (reproduce-first for bug fixes) -> skipped, only docs

[DeusData]

Thanks for correcting the stale .cbmignore documentation and making the existing un-skip behavior discoverable. The exact head is security-clean, DCO-compliant, and CI is green.

One wording contradiction remains: the precedence introduction says “the first layer that rejects a path wins,” while the new section correctly explains that .cbmignore can override an ordinary built-in skip. Please qualify the opening rule with the documented .cbmignore exception. The implementation description and protected safety-core list otherwise match current behavior.