fix(packaging): bump __version__ to 2.4.0a2 + explicit hatch sdist target

Two related cleanups to packaging metadata:

1. src/agent_passport/__init__.py declared __version__ = "2.4.0a1"
   while pyproject.toml + dist/ artifacts are 2.4.0a2. Module constant
   now matches.

2. Add [tool.hatch.build.targets.sdist] with explicit include/exclude
   lists. Hatch's default sweep would otherwise pull in tests/,
   papers/, drafts/, .github/, etc. — none of which belong on PyPI.
   This is the hatch-native equivalent of a setuptools MANIFEST.in.

518 tests still pass.

Surfaced by AUDIT-2026-05-12-fullsweep.md A8 + B5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aeoess

pyproject.toml

@@ -38,5 +38,29 @@ Documentation = "https://aeoess.com/llms-full.txt"
 [tool.hatch.build.targets.wheel]
 packages = ["src/agent_passport"]
 
+# Explicit sdist contents. Hatch's default sdist sweep would otherwise pull
+# in tests/, papers/, drafts/, working-group dossiers, and other repo-local
+# material that has no business shipping to PyPI consumers. This is the
+# hatch-native equivalent of a setuptools MANIFEST.in — explicit beats
+# implicit at audit time.
+[tool.hatch.build.targets.sdist]
+include = [
+  "src/agent_passport/**",
+  "README.md",
+  "LICENSE",
+  "NOTICE",
+  "pyproject.toml",
+  "CHANGELOG.md",
+]
+exclude = [
+  "tests/**",
+  "papers/**",
+  "drafts/**",
+  "docs/drafts/**",
+  ".github/**",
+  "*.log",
+  "*.tgz",
+]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]

src/agent_passport/__init__.py

@@ -28,7 +28,7 @@
 Docs: https://aeoess.com/llms-full.txt
 """
 
-__version__ = "2.4.0a1"
+__version__ = "2.4.0a2"
 
 # Crypto
 from .crypto import generate_key_pair, sign, verify, public_key_from_private