Exclude generated website output from maintained writer source scan

[leehack]

Observed failure

test/unit/tooling/safe_pr_head_update_test.dart test all executable and task sources exclude bypass writers recursively lists all files and excludes root build/, .dart_tool, node_modules and test files, but not website/build/ or website/.docusaurus/ generated executable files.

During independent full VM and docs validation of #486, the existing test read a generated website server bundle while the docs build replaced it:

PathNotFoundException: Cannot open file, path = ./website/build/__server/assets/js/2979.f6c831a8.js
test/unit/tooling/safe_pr_head_update_test.dart 1281:30

The test and ownership filters are unchanged by #486. This is a pre-existing generated-output ownership/race issue exposed by concurrent local docs and VM validation, not a runtime regression introduced by the readiness correction. Validation should be serialized until fixed.

Acceptance

• Scope the executable/task source scan to maintained repository-owned sources, excluding generated site/build/dependency outputs without excluding maintained workflow or writer code.
• Add regression fixtures for nested generated build and Docusaurus paths, preserving positive coverage for maintained executable/task sources.
• Avoid silently swallowing errors for genuine maintained files or weakening forbidden writer checks.
• Full serial VM and docs validation remain green; generated site output cannot cause missing-file or bundled third-party false positives.

Keep separate from #485/#486 metadata-only release readiness logic.