orbit-zip-hygiene

Validate the contents of a WordPress plugin release zip — no dev artefacts (`.git/`, `.cursor/`, `.github/`, `.DS_Store`), no source maps, no `composer.json` / `package.json` (or strip dev deps), no f