构建：从打包数据中剔除 .gitignore 等版本控制残留并加校验

collect_data_files("orisys") 会把 SDK 包内受 git 跟踪的 src/orisys/.gitignore 一并拷进 _internal\orisys；
现在 spec 统一过滤版本控制与缓存文件名，build.ps1 第 6 步对我们自己发布的三个包硬失败、其它位置仅告警。
验证：清理重建 exit 0，dist 内 .git* / __pycache__ / 缓存文件 0 命中，Open3D 检查通过，冒烟测试
打印 "the application started" 与 "the packaged 3D scene loaded"，输出 488.7 MB。

build/studio/build.ps1

@@ -11,7 +11,7 @@
     1. make sure that provisioning happened (and run `setup.ps1` if it plainly has not),
     2. verify the environment can import what the frozen app imports,
     3. build,
-    4. verify the artefact — config, excludes, and a real start-up of the produced EXE.
+    4. verify the artefact — config, excludes, residue, and a real start-up of the produced EXE.
 
   Step 2 and step 4 exist because the interesting failures are silent ones: a stale venv
   still builds (the spec's pathex finds the modules) yet loses the theme data; an excluded
@@ -177,7 +177,36 @@ if ($o3dHits) {
     Write-Host "Open3D check: none found under dist."
 }
 
-# ----------------------------------------------------------------- 6. smoke test
+# -------------------------------------------- 6. no source-control or cache residue
+# PyInstaller copies whatever data a package declares, and `collect_data_files("orisys")`
+# copies every non-Python file the SDK package holds — including the tracked
+# `src/orisys/.gitignore`, which is how `_internal\orisys\.gitignore` got shipped. A file
+# like that is not a crash, so nothing else in this script would notice it; this check is
+# the only thing that keeps it from coming back. It is a hard failure inside the bundles we
+# own, and a warning elsewhere, where the file may belong to a third-party wheel.
+$residueNames = '^(\.git.*|\.gitkeep|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.scratch|\.tox|\.idea|\.vscode)$'
+$ourPackages = @("_internal\orisys", "_internal\orisys_app_shared", "_internal\orisys_studio")
+$residue = @(Get-ChildItem $OutDir -Recurse -Force -ErrorAction SilentlyContinue |
+    Where-Object { $_.Name -match $residueNames })
+$ownedResidue = @()
+foreach ($item in $residue) {
+    $relative = $item.FullName.Substring($OutDir.Length + 1)
+    foreach ($package in $ourPackages) {
+        if ($relative -like "$package\*") { $ownedResidue += $item; break }
+    }
+}
+if ($ownedResidue.Count -gt 0) {
+    Write-Host "Residue inside the bundles we own:"
+    $ownedResidue | ForEach-Object { Write-Host ("  " + $_.FullName.Substring($OutDir.Length + 1)) }
+    throw "the bundle ships $($ownedResidue.Count) source-control/cache file(s); drop them in build\studio\orisys-studio.spec and rebuild"
+} elseif ($residue.Count -gt 0) {
+    Write-Warning "Residue outside our packages ($($residue.Count) item(s)), left alone:"
+    $residue | ForEach-Object { Write-Warning ("  " + $_.FullName.Substring($OutDir.Length + 1)) }
+} else {
+    Write-Host "Residue check: no .git* / __pycache__ / cache files under dist."
+}
+
+# ----------------------------------------------------------------- 7. smoke test
 # Start the EXE the way a user would and require the application's own log to say it came up.
 # This is the step that would have caught every silent failure found in this build.
 $smokeFailed = $false
@@ -276,7 +305,7 @@ if (-not $SkipSmokeTest -and (Test-Path $Exe)) {
     }
 }
 
-# ------------------------------------------------------------------- 7. summary
+# ------------------------------------------------------------------- 8. summary
 if (Test-Path $OutDir) {
     $bytes = (Get-ChildItem $OutDir -Recurse -File -ErrorAction SilentlyContinue |
         Measure-Object -Property Length -Sum).Sum