Fix: exclude .claude/ from sdist to prevent credential exposure

settings.local.json in .claude/ was bundled into all prior sdist releases,
exposing API tokens stored as inline Bash permission patterns. Added:
- .claude/ to .gitignore
- [tool.hatch.build.targets.sdist] exclude = [".claude/"] in pyproject.toml

Bumps to v0.2.6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jgravelle

.gitignore

@@ -49,3 +49,6 @@ dmypy.json
 
 # Storage (don't commit test indexes)
 .code-index/
+
+# Claude Code local settings (may contain credentials from allowed commands)
+.claude/

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "jcodemunch-mcp"
-version = "0.2.5"
+version = "0.2.6"
 description = "Token-efficient MCP server for source code exploration via tree-sitter AST parsing"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -25,6 +25,9 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.wheel]
 packages = ["src/jcodemunch_mcp"]
 
+[tool.hatch.build.targets.sdist]
+exclude = [".claude/"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 asyncio_mode = "auto"