构建：从打包数据中剔除 .gitignore 等版本控制残留并加校验

collect_data_files("orisys") 会把 SDK 包内受 git 跟踪的 src/orisys/.gitignore 一并拷进 _internal\orisys；
现在 spec 统一过滤版本控制与缓存文件名，build.ps1 第 6 步对我们自己发布的三个包硬失败、其它位置仅告警。
验证：清理重建 exit 0，dist 内 .git* / __pycache__ / 缓存文件 0 命中，Open3D 检查通过，冒烟测试
打印 "the application started" 与 "the packaged 3D scene loaded"，输出 488.7 MB。

build/studio/orisys-studio.spec

@@ -71,6 +71,46 @@ def _branding_datas() -> list[tuple[str, str]]:
     return datas
 
 
+#: Source-control and tool-cache names that must never ship. ``collect_data_files`` copies
+#: *every* non-Python file a package contains, and the SDK keeps a tracked
+#: ``src/orisys/.gitignore`` — which is how ``_internal\orisys\.gitignore`` reached the
+#: bundle. The list is deliberately narrow: a real asset (``theme/*.json``, cv2's own
+#: ``config.py``) must survive, so only VCS/cache names are dropped.
+_RESIDUE_NAMES = frozenset(
+    {
+        ".git",
+        ".gitignore",
+        ".gitattributes",
+        ".gitmodules",
+        ".gitkeep",
+        "__pycache__",
+        ".pytest_cache",
+        ".mypy_cache",
+        ".ruff_cache",
+        ".scratch",
+        ".tox",
+        ".idea",
+        ".vscode",
+    }
+)
+_RESIDUE_SUFFIXES = (".pyc", ".pyo", ".orig", ".rej", "~")
+
+
+def _without_residue(datas: list[tuple[str, str]]) -> list[tuple[str, str]]:
+    """Drop VCS/cache residue from collected package data, naming what was dropped."""
+    kept: list[tuple[str, str]] = []
+    dropped: list[str] = []
+    for source, dest in datas:
+        parts = Path(source).parts
+        if any(part in _RESIDUE_NAMES for part in parts) or source.endswith(_RESIDUE_SUFFIXES):
+            dropped.append(source)
+            continue
+        kept.append((source, dest))
+    for item in dropped:
+        print(f"[spec] dropped residue from package data: {item}")
+    return kept
+
+
 block_cipher = None
 
 # Config is copied beside the EXE by build.ps1 (writable / editable).
@@ -92,15 +132,20 @@ hiddenimports = [
 datas += collect_data_files("orisys_app_shared", includes=["theme/*.json"])
 try:
     datas += collect_data_files("orisys")
-except Exception:
-    pass
+except Exception as exc:
+    # Tolerated so a spec run by hand still works, but never silently: a package whose data
+    # cannot be collected loses assets, and that is invisible in the built EXE.
+    print(f"[spec] WARNING: could not collect orisys package data: {exc}")
 try:
     cv2_datas, cv2_binaries, cv2_hidden = collect_all("cv2")
     datas += cv2_datas
     binaries += cv2_binaries
     hiddenimports += list(cv2_hidden)
-except Exception:
-    pass
+except Exception as exc:
+    print(f"[spec] WARNING: could not collect cv2: {exc}")
+
+# Applied last, so it covers every contributor above (including a third-party wheel).
+datas = _without_residue(datas)
 
 icon_path = BRANDING_DIR / "logo.ico"
 icon = str(icon_path) if icon_path.is_file() else None