release: publish gitea allowlist and harden bundle deploy

scripts/scan_release_bundle.py

@@ -13,6 +13,7 @@ BAD_PATH_PARTS = [
     ".venv",
     ".venv-py314",
     ".venv-py312-codex",
+    ".venv-codex-test",
     "venv",
     ".pytest_cache",
     "__pycache__",
@@ -38,6 +39,8 @@ def bad_path(name: str) -> bool:
     wrapped = f"/{name}/"
     if any(f"/{part}/" in wrapped for part in BAD_PATH_PARTS):
         return True
+    if any(part.startswith(".venv-") for part in name.split("/")):
+        return True
     if any(name.endswith(suffix) for suffix in BAD_EXACT_SUFFIXES):
         return True
     if any(name.endswith(suffix) for suffix in BAD_FILE_SUFFIXES):