site-publish: honor site.yaml excludes during S3 sync

site.yaml can now declare excludes: [paths/patterns] that are passed to
`aws s3 sync` and `aws s3 cp` as --exclude flags, so the listed objects
are neither uploaded from the build dir nor deleted from the bucket.
Escape hatch for assets managed out-of-band (e.g. large PDFs uploaded
via aws-cli) that would otherwise be wiped by --delete.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/utils.py

@@ -83,6 +83,10 @@ def parse_site_yaml(site_dir):
     if site_type not in VALID_TYPES:
         die(f"Unknown site type: {site_type} (valid: {', '.join(sorted(VALID_TYPES))})")
 
+    excludes = cfg.get("excludes") or []
+    if not isinstance(excludes, list) or any(not isinstance(p, str) for p in excludes):
+        die("excludes must be a list of string patterns")
+
     site = {
         "domain": cfg["domain"],
         "type": site_type,
@@ -90,6 +94,7 @@ def parse_site_yaml(site_dir):
         "aliases": cfg.get("aliases") or [],
         "content_dir": cfg.get("content_dir", ""),
         "tidy": cfg.get("tidy", True),
+        "excludes": excludes,
     }
 
     print("Site config:")