Keep the agent's build output out of the publication tree

A local 'dotnet build' leaves agent/*/obj and agent/*/bin full of absolute
host paths. They are gitignored, but the export rsyncs the WORKING TREE, so
.gitignore does not apply and the scrub gate stopped the whole export - which
is what it is for, but it made publication depend on whoever built the agent
last having cleaned up.

Same shape as the stray .env.bak the excludes already document. Note the trap
that follows from it: an --exclude also PROTECTS a path from --delete, so the
copies the first failed run had already placed in the publication tree had to
be removed by hand before the next run could pass.

Scope: product

tools/export-github.sh

@@ -123,6 +123,12 @@ done
 
 # NOTE ON EXCLUDES: this walks the WORKING TREE, so .gitignore does not apply.
 # Anything ignored-but-present has to be named here or it reaches publication -
+# The agent's .NET build output (agent/*/obj, agent/*/bin) is gitignored but
+# rsync walks the WORKING TREE, so a local `dotnet build` puts absolute host
+# paths into project.assets.json and friends and the scrub gate stops the whole
+# export. Excluded here rather than left to whoever built the agent last to
+# remember to clean up. Same shape as the .env.bak below.
+#
 # how a stray .env.bak once did, and how devnotes/ (local review writeups, chat
 # handoffs) did. The scrub gate catches such things, which is the point, but a
 # gate failure is a stop, not a filter: add the exclude rather than deleting
@@ -145,6 +151,8 @@ rsync -a --delete \
   --exclude 'tests/test_plugins/test_zabbix_live.py' \
   --exclude 'venv' \
   --exclude 'node_modules' \
+  --exclude 'agent/*/obj' \
+  --exclude 'agent/*/bin' \
   --exclude 'deploy/windows/installer/bundle' \
   --exclude 'deploy/windows/installer/Output' \
   --exclude 'deploy/windows/installer/plugins.iss' \