fix publish.sh: collect file list before orphan branch switch

publish.sh

@@ -29,8 +29,12 @@ if [[ ! -f "$MANIFEST" ]]; then
     exit 1
 fi
 
+# Collect file list AND stage into temp dir before touching git state.
+# Both must happen here — `git rm -rf .` removes the manifest itself,
+# so it can't be re-read during the orphan branch step.
 STAGING="$(mktemp -d)"
 trap 'rm -rf "$STAGING"' EXIT
+FILES=()
 
 while IFS= read -r relpath || [[ -n "$relpath" ]]; do
     [[ -z "$relpath" || "$relpath" == \#* ]] && continue
@@ -46,10 +50,11 @@ while IFS= read -r relpath || [[ -n "$relpath" ]]; do
         echo "ERROR: '${relpath}' in manifest but not found (no override, no original)"
         exit 1
     fi
+    FILES+=("$relpath")
 done < "$MANIFEST"
 
 echo "Files to be published:"
-find "$STAGING" -type f | sed "s|${STAGING}/||" | sort
+printf '  %s\n' "${FILES[@]}"
 
 if $DRY_RUN; then
     echo ""
@@ -57,16 +62,16 @@ if $DRY_RUN; then
     exit 0
 fi
 
+# Create orphan branch, wipe working tree, restore only manifest files
 git -C "$LOCAL_DIR" checkout --orphan _public_tmp
 git -C "$LOCAL_DIR" rm -rf . --quiet
 cp -r "${STAGING}/." "${LOCAL_DIR}/"
 
 TIMESTAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-# Add only files from the manifest — never picks up untracked files not in the manifest
+# Add only manifest files — never picks up untracked files outside the manifest
-while IFS= read -r relpath || [[ -n "$relpath" ]]; do
+for relpath in "${FILES[@]}"; do
-    [[ -z "$relpath" || "$relpath" == \#* ]] && continue
     git -C "$LOCAL_DIR" add -- "$relpath"
-done < "$MANIFEST"
+done
 git -C "$LOCAL_DIR" commit -m "Published ${TIMESTAMP}"
 git -C "$LOCAL_DIR" push --force "$REMOTE" "HEAD:${BRANCH}"