Publish only the work: leave build artifacts out and report them (#80)

The clone gets the standard build artifacts in its own exclude file, so
they never show as changes, even to a model's `git add -A`. The
harness's commits leave the same patterns out even when the project
tracks them, as the sandbox's main did. What was left out is reported in
the publish note and the PR description. Found again in bring-up run 3
(sandbox PR #208).

Fixes #80.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_publish.py

@@ -90,6 +90,9 @@ class FakeGit:
     def commit_all(self, message: str) -> str | None:
         return self.repo.commit_all(message)
 
+    def left_out(self) -> list[str]:
+        return self.repo.left_out()
+
     def push(self, remote_url: str, branch: str, *, credential: object = None) -> None:
         self.pushed.append(branch)
         self.remote[branch] = self.repo.head_sha()
@@ -147,6 +150,23 @@ def test_a_branch_named_after_the_task_does_not_block_publishing(
     assert git.pushed == ["demo-abc-milestone-1"]
 
 
+def test_left_out_artifacts_are_reported_not_published(
+    store: StateStore, tmp_path: Path
+) -> None:
+    git = FakeGit(tmp_path / "work")
+    (tmp_path / "work" / "__pycache__").mkdir()
+    (tmp_path / "work" / "__pycache__" / "work.cpython-310.pyc").write_bytes(b"x")
+    client = FakeGitea()
+    result = build(store, git, client).publish(
+        task_id="t", milestone=1, project="demo", plan="p"
+    )
+    assert "left out 1 build artifact(s): __pycache__/work.cpython-310.pyc" in (
+        result.note
+    )
+    assert "## Left out" in client.opened[0]["body"]
+    assert "`__pycache__/work.cpython-310.pyc`" in client.opened[0]["body"]
+
+
 def test_intent_is_recorded_then_committed(store: StateStore, tmp_path: Path) -> None:
     build(store, FakeGit(tmp_path / "work"), FakeGitea()).publish(
         task_id="t", milestone=1, project="demo", plan="p"