build: harden source distribution contents

[subzeroid]

Summary

• exclude internal/non-package paths from source distributions
• remove public internal planning/backlog files from the repository tree
• add an sdist regression test that builds the tarball and checks forbidden paths

Verification

• uv run ruff check
• uv run ruff format --check
• uv run mypy insto
• uv run pytest --cov=insto --cov-fail-under=75
• uv run python -m build
• tar forbidden-path scan on dist/insto-0.7.13.tar.gz