site-publish: honor site.yaml excludes during S3 sync

site.yaml can now declare excludes: [paths/patterns] that are passed to
`aws s3 sync` and `aws s3 cp` as --exclude flags, so the listed objects
are neither uploaded from the build dir nor deleted from the bucket.
Escape hatch for assets managed out-of-band (e.g. large PDFs uploaded
via aws-cli) that would otherwise be wiped by --delete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -42,6 +42,12 @@ type: static          # static | hugo | mkdocs
 #   - www.my-site.vino.network
 # tidy: true          # set false to skip HTML tidy
 # enabled: true       # set false to decommission
+# excludes:           # paths/patterns to skip during sync (relative to bucket root).
+#   - welcome/welcome.pdf
+#                     # These are passed verbatim to `aws s3 sync --exclude`,
+#                     # so they're both un-uploaded AND un-deleted. Use this
+#                     # for large assets managed out-of-band via aws-cli
+#                     # (e.g. media files updated more often than the site code).
 ```
 
 `.gitea/workflows/publish.yaml`: