Exclude hidden assets from builds and record deployment checks

docs/verification.md

@@ -12,4 +12,12 @@ Local checks on 2026-09-07:
 - Syntax checks pass for both `.mjs` files. Local asset references, unique IDs, fragment links, JSON-LD, sitemap XML, manifest icons and production-file exclusions pass.
 - `npm run build` produces an approximately 807 kB static artifact, including social-preview and icon assets that are not requested during normal page rendering.
 
-For each published revision, check the `showcase/deploy` status on its Gitea commit and compare the served files with `dist`. The repository is public by request. The organization listing is public so anonymous visitors can access it; the existing `hello-world` and `vite-example` repositories retain their private visibility.
+Deployment checks on 2026-09-07:
+
+- The `showcase/deploy` status succeeded for the initial publication on `main`.
+- The exact HTTPS route `https://showcase.andrefiedler.de/2608_BuB/` returns HTTP 200.
+- All 22 public files match the local build byte for byte, including JavaScript modules, fonts, favicon assets, sitemap and manifest.
+- Design originals, preparation scripts, Git configuration and Finder metadata return HTTP 404 on the deployed site.
+- The build excludes hidden files in asset directories.
+
+For each published revision, check the `showcase/deploy` status on its Gitea commit and compare the served files with `dist`.

scripts/build.mjs

@@ -1,5 +1,6 @@
 import { cp, mkdir, rm } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
+import { basename } from 'node:path';
 
 const root = new URL('../', import.meta.url);
 const output = new URL('dist/', root);
@@ -8,6 +9,9 @@ const publicFiles = ['index.html', 'assets', 'favicon.ico', 'favicon.svg', 'site
 await rm(output, { recursive: true, force: true });
 await mkdir(output, { recursive: true });
 for (const filename of publicFiles) {
-  await cp(new URL(filename, root), new URL(filename, output), { recursive: true });
+  await cp(new URL(filename, root), new URL(filename, output), {
+    recursive: true,
+    filter: (source) => !basename(source).startsWith('.'),
+  });
 }
 console.log(`Static site built at ${fileURLToPath(output)}`);