feat(e2b): nightly-local.sh uses tracked-only packing module (P0-2)

Replace inline 'tar --exclude=...' with a one-liner that calls
scripts.e2b.lib.packing.pack_directory — same git ls-files + denylist
+ secret-scan guarantees as the e2b sandbox path. Old tar exclusion
list was a maintenance hazard (any new sensitive dir like experience/
had to be added in two places) and provided weaker guarantees (didn't
catch .env at repo root).

Author: 0xmariowu

scripts/nightly-local.sh

@@ -51,11 +51,12 @@ mkdir -p "${REPORT_DIR}"
 # Matrix upload steps in tests/e2b/matrix.yaml hardcode /tmp/autosearch-src.tar.gz
 # as the source path, so the file on disk has to match that exact name.
 TARBALL="/tmp/autosearch-src.tar.gz"
-tar --exclude='.git' --exclude='node_modules' --exclude='.venv' \
-    --exclude='__pycache__' --exclude='.pytest_cache' \
-    --exclude='*.egg-info' --exclude='reports' --exclude='build' \
-    --exclude='.ruff_cache' --exclude='.orchestrator' \
-    -czf "${TARBALL}" .
+
+# Pack tracked files only (P0-2 fix): scripts.e2b.lib.packing applies
+# git ls-files + denylist so .env / experience/ / evidence/ never enter
+# the sandbox tarball, even if a developer accidentally git-add'd one.
+echo "[nightly-local] packing tracked files only via scripts.e2b.lib.packing"
+"${PY}" -c "from pathlib import Path; from scripts.e2b.lib.packing import pack_directory; pack_directory(Path('${REPO_ROOT}'), Path('${TARBALL}'))"
 
 PARALLEL="${AUTOSEARCH_PARALLEL:-15}"