feat(promote): add --exclude-prompt, so a promoting command need not promote itself

[pdettori]

What this does

Adds --exclude-prompt <name> (repeatable) to promote, so a slash command that drives promotion
can live in the project it promotes without shipping itself.

Why it is needed

promote reads prompts from user scope. With HOME pointed at the project being promoted, that
project's .claude/commands/ is the prompts directory — and build.ts adds every markdown file
there unconditionally, with no exclusion hook (userDenyList reaches only the skill classifier).

That is why the /promote command in #217 had to be installed into real user scope, which in turn
means the authoring session loads the whole of a real ~/.claude (56 travelling skills) while the
promoted run gets one — the local/remote parity gap that sandbox-first authoring (spec §11) exists to
close. With this flag, sandbox placement becomes viable:

promote --entry ship-note --project "$PWD" --exclude-prompt promote

Accounted for in both directions, because the interesting failure is silence

case	behaviour	why
excludes the entry	entry_excluded, error	and it suppresses the unknown_entry that fires from the same cause — one report naming what you typed, not two naming a symptom
matches nothing	prompt_exclude_unmatched, warn	that is what a typo looks like, and a typo here fails in the worst available way: it ships the prompt you asked to omit
matched	prompt_excluded, warn	an omission should never be silent
empty value	rejected at parse time	'' would match no prompt and quietly ship it

TDD, and two things it caught

Eight tests, each watched failing first — five buildBundle behaviours, three CLI.

• A test that passed against the unimplemented feature. requires a value asserted
  /--exclude-prompt/, which unknown flag: --exclude-prompt also matches. Tightened to the
  specific message so it can only pass for the right reason. This is exactly what "watch it fail"
  is for.
• A fixture change with collateral damage. Adding the extra prompts to the shared build fixture
  broke an unrelated test asserting promptNames is ['go']. The fixture is now scoped to the
  exclusion suite rather than the existing expectation loosened — collateral change is not coverage.

Verification

Checked at the CLI, not only in unit tests:

--exclude-prompt promote    → [prompt_excluded] … not in the bundle              exit 0
--exclude-prompt promotte   → [prompt_exclude_unmatched] … check the spelling    exit 0
--exclude-prompt ship-note  → [entry_excluded] … names the entry prompt          exit 2
--exclude-prompt            → --exclude-prompt requires a prompt name            exit 1

make typecheck, make lint (9 hooks), make test-deploy and pnpm -r test all pass — harness
350, knative-server 209, k8s-sandbox 133, experiments 59, relay 16, work-queue 9.

Follow-up, not in this PR

#217 documents real-user-scope placement for /promote and explains it by the self-promotion
problem this flag removes. Once this lands I will update that PR to offer sandbox placement with
--exclude-prompt promote as the parity-preserving option, and keep user scope as the simpler one.
Branched off main rather than stacked on #217 so the flag can be reviewed and merged on its own.

Assisted-By: Claude Code

[pdettori]

Rebased onto main (which now contains #217) — clean, no conflicts, and the branch is flag-only: the runbook/README/command work that depended on this flag moved out to #219 so this PR stays reviewable as one change.

Ready for your manual merge. I did not use the admin override myself: main requires 1 approval, GitHub blocks self-approval, and bypassing a protection you configured is your call rather than mine.

Order matters: merge this first, then #219 — I will rebase #219 afterwards so its diff drops this commit.