构建：从打包数据中剔除 .gitignore 等版本控制残留并加校验

collect_data_files("orisys") 会把 SDK 包内受 git 跟踪的 src/orisys/.gitignore 一并拷进 _internal\orisys；
现在 spec 统一过滤版本控制与缓存文件名，build.ps1 第 6 步对我们自己发布的三个包硬失败、其它位置仅告警。
验证：清理重建 exit 0，dist 内 .git* / __pycache__ / 缓存文件 0 命中，Open3D 检查通过，冒烟测试
打印 "the application started" 与 "the packaged 3D scene loaded"，输出 488.7 MB。

build/README.md

@@ -97,6 +97,7 @@ script checks the things that only show up when the EXE runs:
 | `collect_data_files('orisys_app_shared', includes=['theme/*.json'])` is non-empty | the theme colours are package data; without them the app dies in `build_qss()` before logging anything |
 | every `config\sensors\**\*.oryscene` is present, and the finger manifest/`sensor.json`/unroll map survive the config strip | the 3D pane refuses the scene when the device description cannot be derived |
 | no `open3d*` under `dist` | the offline tool leaking into the shipped bundle |
+| no source-control or cache files in the bundle (`_without_residue` in the spec, step 6 of the script) | a `.gitignore`, `__pycache__` or `.scratch` from the source trees shipping inside `dist` — the SDK keeps a `.gitignore` *inside* the `orisys` package, so `collect_data_files('orisys')` copies it |
 | **smoke test**: start the produced EXE, wait for its own log to say `Studio shell started` (and `3D scene loaded` when a finger scene shipped), then stop it | a bundle that cannot start at all — missing runtime DLLs, an excluded module, missing data. The log is kept under `build\_smoke\` |
 
 The smoke test seeds a `preference.json` beside the EXE to select the finger sensor with the
@@ -116,13 +117,15 @@ never sources.
 ```text
 _internal\orisys_app_shared\theme\colors_dark.json     <- package data, bundled (qss.py reads it)
 _internal\orisys_app_shared\theme\colors_light.json
-_internal\orisys\.gitignore                             <- stray non-.py file of the SDK package
 _internal\branding\...                                  <- logos
 ```
 
 (`collect_data_files("orisys")` exists for the case where the SDK is installed from a wheel that
-bundles `sensors/` assets; with a local editable checkout the only non-`.py` file is that
-`.gitignore`. It is harmless — the app prefers `config\sensors` — but it does look odd.)
+bundles `sensors/` assets. With a local editable checkout its only non-`.py` file *was* the SDK's
+own `src\orisys\.gitignore` — a repository file with no business inside an importable package — so
+it landed here as `_internal\orisys\.gitignore`. The spec now filters source-control and cache
+files out of every `datas` entry, and step 6 of the script fails the build if any survive in a
+package we ship.)
 
 To list what is really in the archive:
 
@@ -185,7 +188,8 @@ Expect ~450 MB total (Qt + numpy/scipy/numba + OpenCV + PyOpenGL).
    appear next to the EXE.
 4. Camera preview + box/mini/finger Run (video) with image modes and force plots.
 5. Open the 3D pane on a finger source: the surface draws, the legend shows the field.
-6. Confirm no `open3d*` files under `dist\OrisysStudio`.
+6. Confirm no `open3d*` files under `dist\OrisysStudio`, and no `.gitignore`/`__pycache__`/
+   `.scratch` anywhere inside it (step 6 of the build fails on residue in our own packages).
 
 ## Editable run (unchanged)