build(export): purge stale generated paths from the publication tree

rsync --exclude also PROTECTS a path from --delete, so anything that reached the
publication tree before its exclude existed stayed there permanently - invisible
to the sync and surfacing only as a scrub-gate failure. That cost two rounds of
'add the exclude, still fails' on the installer bundle and again on
.pytest_cache. The generated paths are now purged before the sync, so adding an
exclude is sufficient on its own.

tests/test_docs_publishable.py assembles its search terms from fragments: a file
containing the literal strings the scrub greps for tripped that scrub on itself.
Excluding the file from publication would have removed the check from the
repository it protects.

tools/export-github.sh

@@ -37,6 +37,16 @@ done
 # git, so it came through anyway - and its copies of config.py and
 # requirements.txt then tripped the scrub gate. Anything else generated into the
 # working tree needs excluding here too, for the same reason.
+# rsync --exclude also PROTECTS a path from --delete, so anything that reached
+# the publication tree before its exclude existed stays there forever, invisible
+# to the sync and caught only by the scrub gate. Purge the generated paths first
+# so adding an exclude is enough on its own.
+for stale in .pytest_cache .ruff_cache htmlcov .coverage \
+             deploy/windows/installer/bundle deploy/windows/installer/Output \
+             deploy/windows/installer/plugins.iss deploy/windows/installer/version.iss; do
+  rm -rf "${PUB:?}/$stale"
+done
+
 rsync -a --delete \
   --exclude '.git' \
   --exclude '.gitea' \
@@ -62,6 +72,10 @@ rsync -a --delete \
   --exclude 'instance' \
   --exclude '.env' \
   --exclude '__pycache__' \
+  --exclude '.pytest_cache' \
+  --exclude '.ruff_cache' \
+  --exclude '.coverage' \
+  --exclude 'htmlcov' \
   --exclude '*.pyc' \
   --exclude 'scripts/site_imports/wjf/idmap.json' \
   "$WORK/" "$PUB/"