package: exclude the .audit run stamp beside /audit

[thedavidmeister]

Closes #172

.soldeerignore is a deny list against an include-everything default, and every
dot-entry that must not ship has its own line — .github, .vscode,
.gitignore, .pre-commit-config.yaml. Line 11 excludes /audit, which settles
that audit metadata is not package content. The sibling .audit/ directory that
the audit convention writes — .audit/runs.jsonl, .audit/scope.json — had no
line, so it shipped.

Reproduced with forge soldeer push --dry-run in this branch's worktree. Before
the change the zip's top level is

.audit  LICENSE  LICENSES  README.md  src  test

and after it is

LICENSE  LICENSES  README.md  src  test

with audit/protofire/* absent on both sides, which is line 11 working and the
dot-sibling slipping past it.

The cost of shipping it is not just the bytes: test/ and .audit/ are inside
the content hash the autopublish gate compares, so an audit stamp commit mints a
rain-factory revision with no source delta, and every later audit repeats it.
/audit beside it is the shape the sibling repos rain.deploy and
rain.datacontract already carry.

.soldeerignore is also #144's and #171's file, one entry each; all three edits
are disjoint lines and each stands alone.

QA

• Discriminating tests: n/a - what the publish step packages is not reachable
  from the forge suite. The before/after dry-run zips above are the
  discriminating evidence.
• Mutations applied: n/a - no src/ or test/ change, so there is no behaviour
  to mutate.
• Oracle: the zip forge soldeer push --dry-run actually produces, rather than
  reading the ignore list and reasoning about what it matches.
• Category check: the issue asks for (A) .audit/ reaching the package; covered
  A. The whole list was re-derived from the dry-run zip rather than from the
  file, which is how the general form was checked: the only remaining top-level
  entries in the package are src/, test/, README.md, LICENSE and
  LICENSES/, and test/ is [F40] [LOW] .soldeerignore does not exclude test/, so the published package ships uncompilable test sources and republishes on every test-only merge #144's issue, not a second instance of this one.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a3e56618-fa39-42aa-b7a9-e0b84eb1a30a

📥 Commits

Reviewing files that changed from the base of the PR and between 710dff5 and 149118b.

📒 Files selected for processing (1)

• .soldeerignore

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}