Harden gemspec files list to an explicit git-tracked allowlist (herb-embedded-78l)

[jleo3]

Summary

• spec.files now builds from git ls-files filtered by per-directory regex (lib/**/*.rb, vendor/**/*.js, js/**/*.js, exe/* non-recursive) instead of Dir[] globs, per guides.rubygems.org/security's explicit recommendation: "Build your files list from explicit allowlists (like git ls-files) rather than broad globs."
• Rationale: a pushed gem is public and widely mirrored, so a stray file matching a broad glob (a local debug script, an untracked scratch file) would silently ship with no review catching it before gem push — and a published version can only be yanked, not recalled from whoever already has it.

Acceptance criteria

• spec.files built from a git-tracked allowlist, not Dir[] globs.
• gem build succeeds and the resulting package's file list matches exactly what the current Dir[]-based gemspec produced — verified two ways: (1) a script comparing the old and new file sets directly on the repo (byte-for-byte identical, 22 files), specifically confirming js/entry.mjs (git-tracked but not .js, a build-time-only esbuild entry point) stays correctly excluded the same way the old glob excluded it; (2) bundle exec rake build + gem specification pkg/herb-embedded-0.10.3.0.gem files on the actual built package.
• bundle exec rake passes locally (206 examples, 0 failures, 0 RuboCop offenses) — plus a real end-to-end smoke test: installed the freshly-built .gem into the real gem environment and ran herb-lint-rb against a fixture, confirming Bridge#boot's direct file-path references to vendor/herb-linter.js and js/*.js still resolve correctly from the new file list.

Test plan

• bundle exec rake passes locally.
• File-set equivalence verified via script (old vs. new produce identical output).
• Real gem build → gem install → herb-lint-rb <fixture> round trip produces a correct diagnostic.

🤖 Generated with Claude Code