fix: bake package ignore rules into skill publish release

Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>

Author: kantorcodes

README.md

@@ -12,7 +12,7 @@ Immutability gives you:
 
 A skill package is `SKILL.md` + `skill.json` (plus optional files). The action validates, quotes, publishes, waits for completion, and emits outputs.
 
-By default, `skill-publish` excludes hidden files, env files, lockfiles, build output, local databases, and key/certificate material from package discovery before quote or publish.
+By default, `skill-publish` excludes hidden files and directories, env files, lockfiles, build output, local databases, and key/certificate material from package discovery before quote or publish.
 
 [![npm](https://img.shields.io/npm/v/skill-publish?style=for-the-badge&logo=npm)](https://www.npmjs.com/package/skill-publish)
 [![GitHub Marketplace](https://img.shields.io/badge/GitHub_Marketplace-skill--publish-2EA44F?style=for-the-badge&logo=github)](https://github.com/marketplace/actions/skill-publish)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "skill-publish",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Publish trustless, immutable, on-chain skill releases via the HOL Registry Broker.",
   "type": "module",
   "homepage": "https://hol.org/registry/skills/publish",
@@ -59,6 +59,7 @@
   },
   "scripts": {
     "lint": "node --check entrypoint.mjs && node --check bin/cli.mjs && node --check bin/lib/broker-api.mjs && node --check bin/lib/create-command.mjs && node --check bin/lib/credential-store.mjs && node --check bin/lib/setup-command.mjs && node --check bin/lib/account-commands.mjs && node --check bin/lib/local-commands.mjs && node --check bin/lib/doctor-command.mjs && node --check bin/lib/start-command.mjs && node --check bin/lib/cli-help.mjs && node --check bin/lib/repo-commands.mjs && node --check bin/lib/package-files.mjs && node --check bin/lib/skill-package.mjs && node --check bin/lib/skill-presets.mjs && node --check bin/lib/distribution-kit.mjs && node --check bin/lib/distribution-commands.mjs && node --check bin/lib/codemeta.mjs && node --check bin/lib/indexnow.mjs && node --check bin/lib/apply-distribution-kit.mjs",
+    "test:package-files": "node test/package-files.test.mjs",
     "smoke:help": "node bin/cli.mjs --help",
     "smoke:start": "node bin/cli.mjs start --non-interactive",
     "smoke:doctor": "node bin/cli.mjs doctor --json",

test/package-files.test.mjs

@@ -0,0 +1,33 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { discoverSkillPackageFiles } from '../bin/lib/package-files.mjs';
+
+const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'skill-publish-test-'));
+
+try {
+  await writeFile(path.join(tempRoot, 'SKILL.md'), '# Test skill\n');
+  await writeFile(path.join(tempRoot, 'skill.json'), '{"name":"test-skill","version":"1.0.0"}\n');
+  await mkdir(path.join(tempRoot, '.github', 'workflows'), { recursive: true });
+  await writeFile(path.join(tempRoot, '.github', 'workflows', 'publish.yml'), 'name: publish\n');
+  await mkdir(path.join(tempRoot, '.hidden-cache'), { recursive: true });
+  await writeFile(path.join(tempRoot, '.hidden-cache', 'artifact.txt'), 'secret-ish\n');
+  await mkdir(path.join(tempRoot, 'docs'), { recursive: true });
+  await writeFile(path.join(tempRoot, 'docs', 'guide.md'), 'Guide\n');
+  await writeFile(path.join(tempRoot, '.env.local'), 'RB_API_KEY=should-not-ship\n');
+
+  const result = await discoverSkillPackageFiles(tempRoot);
+  const included = result.includedFiles.map((file) => file.relativePath).sort();
+  const excluded = result.excludedFiles.map((file) => `${file.relativePath}:${file.reason}`).sort();
+
+  assert.deepEqual(included, ['SKILL.md', 'docs/guide.md', 'skill.json']);
+  assert.ok(excluded.includes('.github/:blocked-directory'));
+  assert.ok(excluded.includes('.hidden-cache/:hidden-path'));
+  assert.ok(excluded.includes('.env.local:hidden-path'));
+
+  process.stdout.write('package-files discovery test passed\n');
+} finally {
+  await rm(tempRoot, { recursive: true, force: true });
+}