Directory hashes ignore dot-prefixed files and folders #19

The patched ContentDir._calc_hash and Dir._calc_hash hash every file that iter(ContentDir) yields. redun lists those files with glob.glob(os.path.join(path, "**"), recursive=True) (redun 0.44.1, LocalFileSystem.glob), and glob skips names starting with . unless include_hidden=True. Dotfiles and everything under dot-directories are therefore not part of any directory hash, and changing or deleting them doesn't invalidate a cached result.

Relevant code: _redun_compat.py, lines 30–49.

Reproduction:

import mkcd2app  # applies the patches
from redun.file import ContentDir
# nm/ contains .bin/vite, vite/index.js and .package-lock.json
before = ContentDir("nm"); before.hash
# delete nm/.bin/ and nm/.package-lock.json
ContentDir("nm").hash == before.hash  # True
before.is_valid()                     # True

Consequences:

• The toolchain's install_js_tools returns js_tools/node_modules, but builds run mkc from node_modules/.bin (utils/paths.py, lines 57–58). If .bin/mkc is deleted or broken, toolchain install still treats the install as valid and doesn't repair it.
• The same applies to node_modules/.bin/vite in x-website-deps, which every npm run build* needs.
• A future template .npmrc, .env or .nvmrc (likely for Electron mirrors or engine settings) wouldn't invalidate copy_website_template or warm_npm_cache_for_templates.
• A public/.nojekyll or similar in a built site isn't tracked.

It currently also keeps a git source's .git/ out of the source hash, which may be desirable. That should be an explicit exclusion rather than a side effect of glob. tests/unit/test_redun_compat.py doesn't cover dotfiles.

Expected behavior: directory hashes include dot-prefixed entries (for example, by walking with os.walk or glob(..., include_hidden=True) in the patch), with any intended exclusions such as .git listed explicitly, plus a test.

Found while reviewing PR #7, toolchain at ce12c48.