Publish only the work: leave build artifacts out and report them (#80)

The clone gets the standard build artifacts in its own exclude file, so
they never show as changes, even to a model's `git add -A`. The
harness's commits leave the same patterns out even when the project
tracks them, as the sandbox's main did. What was left out is reported in
the publish note and the PR description. Found again in bring-up run 3
(sandbox PR #208).

Fixes #80.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_git.py

@@ -195,3 +195,52 @@ def test_an_https_token_answers_git_through_the_helper(
     assert asked.stdout == "username=[redacted]\npassword=[redacted]\n"
     stored = ssh_host.execute(f"{body} store", secrets={"NISSE_PUSH_TOKEN": "x"})
     assert stored.stdout == ""
+
+
+# --- build artifacts are never the work (#80, D4) ----------------------------
+
+
+def test_artifacts_are_left_out_even_when_the_project_tracks_them(
+    repo: GitRepo,
+) -> None:
+    # The sandbox's main tracks .pyc files (an earlier run published them).
+    cache = repo.root / "pkg" / "__pycache__"
+    cache.mkdir(parents=True)
+    (repo.root / "pkg" / "m.py").write_text("x = 1\n")
+    (cache / "m.cpython-312.pyc").write_bytes(b"old")
+    repo._git("add", "-A")
+    repo._git("commit", "-qm", "a project that tracks its caches")
+
+    # A test run: the tracked .pyc changes, new caches appear, and the work.
+    (cache / "m.cpython-312.pyc").write_bytes(b"new")
+    (cache / "m.cpython-310.pyc").write_bytes(b"x")
+    (repo.root / ".pytest_cache").mkdir()
+    (repo.root / ".pytest_cache" / "v").write_text("x")
+    (repo.root / "pkg" / "m.py").write_text("x = 2\n")
+
+    assert repo.commit_all("the work") is not None
+    committed = repo._git("show", "--name-only", "--format=", "HEAD").split()
+    assert committed == ["pkg/m.py"]
+    assert repo.left_out() == [
+        ".pytest_cache/v",
+        "pkg/__pycache__/m.cpython-310.pyc",
+        "pkg/__pycache__/m.cpython-312.pyc",
+    ]
+
+
+def test_only_artifacts_changed_means_nothing_to_commit(repo: GitRepo) -> None:
+    (repo.root / "__pycache__").mkdir()
+    (repo.root / "__pycache__" / "a.pyc").write_bytes(b"x")
+    assert repo.commit_all("nothing real") is None
+
+
+def test_excludes_hide_new_artifacts_and_install_once(repo: GitRepo) -> None:
+    repo.install_excludes()
+    repo.install_excludes()
+    exclude = (repo.root / ".git" / "info" / "exclude").read_text()
+    assert exclude.count("__pycache__/") == 1
+    (repo.root / "node_modules").mkdir()
+    (repo.root / "node_modules" / "x.js").write_text("x")
+    (repo.root / "real.py").write_text("x")
+    # Even the model's own `git add -A` now skips them.
+    assert repo._git("status", "--porcelain", "--untracked-files=all") == "?? real.py"