chore(deploy): exclude dev tooling and repo docs from testes deploy (#392)

User reported finding dev-only files on the testes server after the
first successful deploy. Categories cleaned up:

Repo metadata:
- .githooks/, .distignore

Build / dependency manifests:
- composer.json, composer.lock, package.json, package-lock.json

Static analysis / testing tools:
- phpstan-stubs.php, patchwork.json

Lint configs (the existing `.eslintrc*` pattern doesn't match ESLint v9
flat config naming `eslint.config.{js,mjs,cjs}` — added the flat
pattern explicitly):
- eslint.config.*

Repo docs (live on GitHub, not in plugin runtime):
- CONTRIBUTING.md, SECURITY.md

Intentionally kept (per user preference): CHANGELOG.md — useful for
historical lookup via SSH; not surfaced to end users (WP.org parses
`readme.txt`'s own changelog section).

The previous "composer.json e package.json são intencionalmente
enviados" rationale was hand-wavy (managed hosting admins might
inspect them) and the user disagreed in practice. Comment block
rewritten to reflect the new policy.

Next push to develop triggers a redeploy; rsync `--delete` will remove
the listed files from the testes server in the same pass.

Co-authored-by: Claude <noreply@anthropic.com>

Author: rpgmem

.github/workflows/deploy-develop.yml

@@ -65,20 +65,24 @@ jobs:
           # - VCS / CI metadata que não pertence ao runtime do plugin.
           # - Dependências de dev (composer require-dev only, node_modules).
           # - Testes e ferramentas de análise estática.
-          # - Configurações locais (wp-config-local.php).
+          # - Manifests de build/lint (composer.json, package.json e locks
+          #   não servem runtime do WordPress; analisadores externos não
+          #   precisam deles na pasta do plugin em produção).
+          # - Docs de repositório (CONTRIBUTING.md, SECURITY.md) que vivem
+          #   no GitHub e não no runtime. `CHANGELOG.md` é mantido por
+          #   preferência — consulta histórica via SSH.
           # - Saídas de coverage / build intermediário.
-          # `composer.json` e `package.json` são intencionalmente
-          # *enviados* — admins de hospedagem gerenciada às vezes os
-          # inspecionam pra entender o que está rodando.
           # `StrictHostKeyChecking=accept-new`: TOFU — aceita a chave do
           # host na primeira conexão e exige match em conexões futuras.
           # Mais seguro que `no` (vulnerável a MITM); funciona quando o
           # `ssh-keyscan` acima falhou silenciosamente.
           rsync -avz --delete \
             --exclude='.git/' \
             --exclude='.github/' \
+            --exclude='.githooks/' \
             --exclude='.gitignore' \
             --exclude='.gitattributes' \
+            --exclude='.distignore' \
             --exclude='vendor/' \
             --exclude='node_modules/' \
             --exclude='tests/' \
@@ -91,12 +95,21 @@ jobs:
             --exclude='phpunit.xml.dist' \
             --exclude='phpstan.neon' \
             --exclude='phpstan.neon.dist' \
+            --exclude='phpstan-stubs.php' \
             --exclude='phpcs.xml' \
             --exclude='phpcs.xml.dist' \
+            --exclude='patchwork.json' \
             --exclude='.eslintrc*' \
+            --exclude='eslint.config.*' \
             --exclude='.stylelintrc*' \
             --exclude='vitest.config.*' \
+            --exclude='composer.json' \
+            --exclude='composer.lock' \
+            --exclude='package.json' \
+            --exclude='package-lock.json' \
             --exclude='CLAUDE.md' \
+            --exclude='CONTRIBUTING.md' \
+            --exclude='SECURITY.md' \
             --exclude='html/' \
             -e "ssh -i ~/.ssh/deploy_key -p $PORT -o StrictHostKeyChecking=accept-new" \
             ./ "${SSH_USER}@${SSH_HOST}:${REMOTE_PATH}/"