Exclude dependency instructions from Windows builds

Signed-off-by: Joseph Yaksich <gitcommit90@users.noreply.github.com>

Author: gitcommit90

scripts/package-windows.cjs

@@ -21,6 +21,10 @@ const IGNORE_NON_RUNTIME_ROOTS = /^\/(?!package\.json$|LICENSE$|NOTICE$|desktop(
 // well adds deeply nested Radix paths that legacy Squirrel/NuGet cannot
 // releasify under Windows' 260-character path limit.
 const IGNORE_CLIENT_BUILD_MODULES = /^\/node_modules\/@excalidraw(?:$|\/)/;
+// Some production dependencies publish maintainer instruction files. They are
+// useful in source checkouts but are not runtime assets and must not enter an
+// installed app or release package.
+const IGNORE_INSTRUCTION_FILES = /\/AGENTS\.md$/;
 
 if (process.platform !== "win32" || process.arch !== "x64") throw new Error("Windows packaging must run on Windows x64.");
 if (!/^\d+\.\d+\.\d+$/.test(VERSION)) throw new Error("package.json must contain a release version.");
@@ -83,7 +87,7 @@ async function main() {
       dir: ROOT, name: PRODUCT, executableName: PRODUCT, appCopyright: "Copyright (c) 2026 Joseph Yaksich",
       win32metadata: { CompanyName: "Joseph Yaksich", FileDescription: PRODUCT, OriginalFilename: "1Helm.exe", ProductName: PRODUCT, InternalName: PRODUCT },
       platform: "win32", arch: "x64", out: windowsScratch, overwrite: true, prune: true, asar: false, icon: ico,
-      ignore: [IGNORE_NON_RUNTIME_ROOTS, IGNORE_CLIENT_BUILD_MODULES, /\.DS_Store$/, /\.log$/],
+      ignore: [IGNORE_NON_RUNTIME_ROOTS, IGNORE_CLIENT_BUILD_MODULES, IGNORE_INSTRUCTION_FILES, /\.DS_Store$/, /\.log$/],
     });
     const appExe = path.join(appDir, "1Helm.exe");
     if (!fs.existsSync(appExe)) throw new Error("Packaged Windows application is missing 1Helm.exe.");

test/desktop.mjs

@@ -155,6 +155,8 @@ test("desktop entrypoint keeps the renderer sandboxed and data on the Mac", asyn
   assert.match(windowsPackager, /path\.join\(DIST, path\.basename\(nupkg\)\)/, "the uploaded package keeps the exact basename referenced by RELEASES");
   assert.match(windowsPackager, /signPackagedExecutables\(appDir\)/, "release signing covers nested Windows executables before packaging");
   assert.match(windowsPackager, /IGNORE_CLIENT_BUILD_MODULES/, "Windows packaging omits client source already compiled into the browser bundle");
+  assert.match(windowsPackager, /IGNORE_INSTRUCTION_FILES/, "Windows packaging omits dependency maintainer instructions");
+  assert.match(windowsPackager, /\/AGENTS\\\.md\$/, "Windows packages never include dependency AGENTS.md files");
   assert.match(windowsPackager, /fs\.mkdtempSync\(path\.join\(path\.parse\(ROOT\)\.root, "1hw-"\)\)/, "the packaged app and Squirrel staging tree share a drive-root scratch path compatible with legacy Windows path handling");
   for (const [source, requiredPaths] of [
     [windowsPackager, ["/scripts", "/scripts/1helm-oci-runtime", "/scripts/mnemosyne-bridge.py", "/scripts/install-wsl-runtime.ps1", "/scripts/windows-removal.cjs", "/deploy/1helm-oci-runtime-v1.conf", "/container/Containerfile.oci"]],