build(sdist): drop .github/workflows so CI-only commits stop moving the sdist hash

The sdist whitelist included `/.github/workflows`, which meant any commit touching CI changed the sdist for an otherwise-unchanged package. That defeats `uv publish --check-url`: it compares the freshly-built file against the index and errors on a mismatch, so a version already on PyPI can no longer be recognized as already-published.

v1.5.0 is the worked example. It was published by hand from the release commit, then #57 added `--check-url` to publish.yml — a workflow-only change that nonetheless altered the sdist, because the workflow file ships inside it. The Release's publish run skipped the wheel correctly ("already exists, skipping") and then failed on the sdist with a sha256 mismatch. No tag target could have avoided it: the release event takes both the workflow and the checkout from the tagged commit, so tagging the pre-fix commit runs a publish without `--check-url` and fails on the duplicate instead.

CI definitions are not buildable-from-source content — nobody runs this project's GitHub Actions from a PyPI tarball — so the entry bought nothing and cost hash stability.

Verified: building the sdist, appending a line to `.github/workflows/lint.yml`, and rebuilding now produces an identical sha256, where before the hash moved. `uv build` still builds the wheel from the sdist, so the whitelist remains complete.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: vdavez

pyproject.toml

@@ -126,13 +126,19 @@ packages = ["tango"]
 # diaries, scratch reports, etc.) when anyone runs `uv publish` locally.
 # The explicit whitelist is belt-and-suspenders for that foot-gun: even
 # from a developer laptop, only these paths can ever end up on PyPI.
+#
+# `.github/workflows` is deliberately NOT included. CI definitions are not
+# buildable-from-source content, and shipping them makes the sdist hash move
+# on every CI-only commit even though the package is unchanged — which breaks
+# `uv publish --check-url`'s ability to recognize an already-published version
+# and turns the Release that triggers it red. That is not hypothetical: it is
+# what happened to v1.5.0.
 [tool.hatch.build.targets.sdist]
 include = [
     "/tango",
     "/tests",
     "/docs",
     "/scripts",
-    "/.github/workflows",
     "/README.md",
     "/LICENSE",
     "/CHANGELOG.md",