fix publish.sh: add only manifest files, not all untracked

publish.sh

@@ -62,7 +62,11 @@ git -C "$LOCAL_DIR" rm -rf . --quiet
 cp -r "${STAGING}/." "${LOCAL_DIR}/"
 
 TIMESTAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-git -C "$LOCAL_DIR" add -A
+# Add only files from the manifest — never picks up untracked files not in the manifest
+while IFS= read -r relpath || [[ -n "$relpath" ]]; do
+    [[ -z "$relpath" || "$relpath" == \#* ]] && continue
+    git -C "$LOCAL_DIR" add -- "$relpath"
+done < "$MANIFEST"
 git -C "$LOCAL_DIR" commit -m "Published ${TIMESTAMP}"
 git -C "$LOCAL_DIR" push --force "$REMOTE" "HEAD:${BRANCH}"