chore(packaging): whitelist sdist contents to block local-publish leaks

Hatchling's default sdist behavior packs everything in the project root,
which is fine in CI (clean checkout) but ships per-developer state from
a laptop: .mg-tools/, .claude/, .claude.bak.*/, CLAUDE.md, ROADMAP.md,
work diaries, scratch reports, .coverage, etc. None of those have ever
been on PyPI because every release has shipped via the publish.yml
workflow's clean GitHub Actions checkout — but a single accidental
`uv publish` from a dev machine would have leaked all of them.

This adds an explicit `[tool.hatch.build.targets.sdist]` include list
plus a small exclude list for the internal docs that live inside
included dirs (docs/DEVELOPERS.md, docs/quick_start.ipynb). Even from a
developer's laptop, only the listed paths can now end up on PyPI.

Verified locally: `uv build` produces a sdist whose top-level entries
are .github, .gitignore, CHANGELOG.md, docs, LICENSE, PKG-INFO,
pyproject.toml, README.md, scripts, tango, tests. No more .mg-tools,
.claude, CLAUDE.md, .coverage, DEVELOPERS.md, or quick_start.ipynb.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: infinityplusone

pyproject.toml

@@ -122,6 +122,34 @@ exclude_lines = [
 [tool.hatch.build.targets.wheel]
 packages = ["tango"]
 
+# Sdist whitelist — `uv build` / `hatch build sdist` only includes these.
+#
+# Hatchling's default behavior packs everything in the project root that
+# isn't matched by .gitignore, which is fine in CI (clean checkout) but
+# leaks per-developer state (`.mg-tools/`, `.claude/`, `CLAUDE.md`, work
+# diaries, scratch reports, etc.) when anyone runs `uv publish` locally.
+# The explicit whitelist is belt-and-suspenders for that foot-gun: even
+# from a developer laptop, only these paths can ever end up on PyPI.
+[tool.hatch.build.targets.sdist]
+include = [
+    "/tango",
+    "/tests",
+    "/docs",
+    "/scripts",
+    "/.github/workflows",
+    "/README.md",
+    "/LICENSE",
+    "/CHANGELOG.md",
+    "/pyproject.toml",
+]
+exclude = [
+    # Internal-only docs / artifacts that exist inside the included dirs.
+    "/docs/DEVELOPERS.md",
+    "/docs/quick_start.ipynb",
+    "**/__pycache__",
+    "**/*.pyc",
+]
+
 [[tool.mypy.overrides]]
 module = "tango.webhooks.cli"
 disallow_untyped_decorators = false