chore: exclude docs/figs asset scripts from Codacy analysis

The logo generator shells out to rsvg-convert with fixed arguments, which
Bandit flags (B404/B603/B607). It's a developer-only script, not package
code, so exclude the folder rather than scattering nosec pragmas.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: petercorke

.codacy.yml

@@ -0,0 +1,7 @@
+---
+exclude_paths:
+  # Developer scripts that regenerate documentation assets (e.g. the README
+  # logo), not part of the installed package. They shell out to fixed
+  # commands like rsvg-convert, which Bandit flags (B404/B603/B607) even
+  # though no untrusted input is involved.
+  - "docs/figs/**"