packageFiles() now states the dot-directory exclusion in its JSDoc, and the
inline comment no longer names one concrete temporary-root prefix. The spec
title describes what the case checks, and the case also asserts a manifest one
level below the root so an implementation that only scans the root fails.