Improve payload construction, size enforcement, and full scan correctness

.gitignore

@@ -17,10 +17,12 @@ pnpm-debug.log*
 /node_modules
 
 # Build output
-# For MOST Node.js projects, you would ignore the build output directory.
-# However, for a GitHub Action packaged with ncc, the 'dist' directory
-# MUST be committed to the repository. Therefore, this line is commented out.
-# /dist
+# Only the ncc-bundled files are needed for the GitHub Action to run.
+# All other tsc output in dist/ is ignored.
+/dist/*
+!/dist/index.js
+!/dist/sourcemap-register.js
+!/dist/licenses.txt
 
 # TypeScript cache files
 # These files are used by the TypeScript compiler to speed up compilation.

.husky/pre-commit

@@ -14,10 +14,12 @@ npm test
 echo "🔨 Building dist/..."
 npm run build && npm run package
 
-# 3. Stage any dist/ changes so the commit includes the fresh build
-if ! git diff --quiet dist/; then
-  echo "📦 dist/ has changed — staging updated files..."
-  git add dist/
-else
-  echo "✅ dist/ is up-to-date."
-fi
+# 3. Stage only the bundled files needed by the action
+for f in dist/index.js dist/sourcemap-register.js dist/licenses.txt; do
+  if [ -f "$f" ] && ! git diff --quiet "$f" 2>/dev/null; then
+    echo "📦 $f has changed — staging..."
+    git add "$f"
+  fi
+done
+
+echo "✅ dist/ is up-to-date."