build(zarr-metadata): the sdist ships an allowlist, not whatever is lying around (#4248)

hatchling had no sdist configuration here either, so a source distribution
carried everything in the package directory. Building from a working tree with
scratch files in it put `.env.local`, a notebook and a `__scratch/` dump in the
tarball. A tagged release builds from a fresh CI checkout and so was never
actually at risk, but nothing made that a property of the package rather than
of the runner.

The list is derived from this package rather than copied from zarr-indexing,
which needed `docs/snippets` and `examples/` because its suite executes them.
Nothing here does: every fixture is a JSON file next to the test module that
reads it, so `/tests` is the whole test dependency. `/docs` and `/mkdocs.yml`
ride along because they are self-contained — mkdocstrings reads `src` and the
config reaches nowhere outside the package — so the sdist documents itself as
well as tests itself. `changes/` and `.readthedocs.yaml` are left out: towncrier
fragments are repo bookkeeping, and the RTD config addresses paths from the
repo root, where an unpacked sdist is not.

Verified by unpacking the built sdist into a bare venv and working from there:
595 tests pass and `mkdocs build --strict` succeeds.

Assisted-by: ClaudeCode:claude-opus-5

Author: d-v-b

packages/zarr-metadata/pyproject.toml

@@ -71,6 +71,26 @@ raw-options = { root = "../..", git_describe_command = "git describe --dirty --t
 [tool.hatch.build.targets.wheel]
 packages = ["src/zarr_metadata"]
 
+# An allowlist, so nothing that merely happens to sit in the package directory
+# — a scratch script, a stray notebook — can ride along in a release. The list
+# keeps an sdist self-testing and self-documenting: every fixture this suite
+# reads is a JSON file sitting next to the test module that loads it, so
+# `/tests` is the whole test dependency, and `/docs` plus `/mkdocs.yml` are a
+# self-contained site (mkdocstrings reads `src`, nothing reaches outside the
+# package) so `just docs-check` runs from an unpacked sdist too. `changes/`
+# and `.readthedocs.yaml` are deliberately absent: towncrier fragments are
+# repo bookkeeping, and the RTD config addresses paths from the repo root.
+# `pyproject.toml`, `README.md` and `LICENSE.txt` are added by hatchling itself.
+[tool.hatch.build.targets.sdist]
+include = [
+    "/src",
+    "/tests",
+    "/docs",
+    "/mkdocs.yml",
+    "/justfile",
+    "/CHANGELOG.md",
+]
+
 [tool.ruff]
 extend = "../../pyproject.toml"
 target-version = "py311"