fix(extension): exclude the test/ and scripts/ directory entries from the XPI

The XPI-content check added in 1c6452e did its job on its first run: the
archive carried empty `test/` and `scripts/` entries.

`test/**` matches the files inside a directory but not the directory entry
itself, and web-ext writes an entry for the directory separately -- so the
contents were correctly excluded while the empty directories shipped anyway.
Nothing harmful reached users (no dev code, just two empty entries), but our
single declaration claimed these do not ship and something was shipping.

Both forms are now listed per directory. The bare name alone would not do:
minimatch's `test` does not match `test/url.spec.js`, so dropping the glob
would ship the contents instead.

Verified locally: the derived version is unchanged at 1.0.19, confirming the
added entries are redundant for the git pathspec and only affect web-ext.

Refs #2400

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

extension/scripts/packaging.sh

@@ -25,7 +25,14 @@ set -euf
 # Split by whether git tracks them: node_modules and web-ext-artifacts are
 # build/dependency output that never appears in a commit, so they belong in
 # web-ext's ignore list but would be meaningless in a git pathspec.
-NOT_PACKAGED_TRACKED='package.json package-lock.json README.md .gitignore vitest.config.js scripts/** test/**'
+#
+# Directories need BOTH forms. `test/**` matches the files inside, but not the
+# directory entry itself — web-ext writes an entry for the directory too, so
+# with only the glob the XPI ends up carrying empty `test/` and `scripts/`
+# entries (caught by the XPI-content check on 2026-08-03). The bare name alone
+# is not enough either: minimatch's `test` does not match `test/url.spec.js`,
+# so dropping the glob would ship the contents. Keep both.
+NOT_PACKAGED_TRACKED='package.json package-lock.json README.md .gitignore vitest.config.js scripts scripts/** test test/**'
 NOT_PACKAGED_BUILD='web-ext-artifacts node_modules'
 
 usage() {

extension/test/version.spec.js

@@ -54,9 +54,14 @@ describe('packaging.sh — the single definition of what ships', () => {
     // omitting either would ship dev tooling to users -- and `test/**` in
     // particular only survives because callers `set -f` before substituting it.
     const ignore = packaging('ignore')
-    expect(ignore).toContain('test/**')
-    expect(ignore).toContain('scripts/**')
     expect(ignore).toContain('vitest.config.js')
+    // Both forms per directory. The glob covers the contents; the bare name
+    // covers the directory ENTRY, which web-ext writes separately — with only
+    // the glob, the XPI carries an empty `test/` and `scripts/`.
+    for (const dir of ['test', 'scripts']) {
+      expect(ignore, `${dir} contents`).toContain(`${dir}/**`)
+      expect(ignore, `${dir} directory entry`).toContain(dir)
+    }
   })
 })