build(export): keep the installer's staged bundle out of publication

The sync walks the working tree rather than git, so deploy/windows/installer/
bundle came through despite being gitignored - about 100MB of build output
containing a copy of the whole application tree, the wheels and the vendor
installers. Its copies of config.py and requirements.txt then tripped the scrub
gate, which is the only reason it was noticed.

Excluded along with the installer's other generated files. Note that rsync
--exclude also protects a path from --delete, so a copy already in the
publication tree has to be removed by hand once.

tools/export-github.sh

@@ -30,6 +30,13 @@ done
 [ -d "$PUB/.git" ] || { echo "publication repo missing at $PUB"; exit 1; }
 
 # --- 1. sync the tree (working -> pub), minus everything never published ---
+#
+# NOTE the deploy/windows/installer/bundle exclude below. That is ~100MB of build
+# output holding a COPY of the whole application tree plus the wheels and vendor
+# installers. It is gitignored, but this sync walks the WORKING TREE rather than
+# git, so it came through anyway - and its copies of config.py and
+# requirements.txt then tripped the scrub gate. Anything else generated into the
+# working tree needs excluding here too, for the same reason.
 rsync -a --delete \
   --exclude '.git' \
   --exclude '.gitea' \
@@ -45,6 +52,10 @@ rsync -a --delete \
   --exclude 'tests/test_plugins/test_zabbix_live.py' \
   --exclude 'venv' \
   --exclude 'node_modules' \
+  --exclude 'deploy/windows/installer/bundle' \
+  --exclude 'deploy/windows/installer/Output' \
+  --exclude 'deploy/windows/installer/plugins.iss' \
+  --exclude 'deploy/windows/installer/version.iss' \
   --exclude 'frontend/dist*' \
   --exclude 'frontend/src/.plugins-staged' \
   --exclude 'frontend/src/router/routes.gen.js' \