Play Framework

fix: playBundle excludes certs/ — secrets must come from runtime, not artifact (PF-90)

Security issue surfaced by user: the previous playBundle implementation
included certs/ in the include-list, which meant deployment zips would
ship:

- certs/host.cert (TLS material)
- certs/host.key (TLS private key)
- certs/.env (the actual PLAY_SECRET value)

These should never be baked into deployment artifacts. Standard
deployment pattern: runtime provides them via mounted volume / Docker
secrets / k8s Secret resources / vault-injection sidecar / etc.

Fix: drop certs/ from includeTopLevel. The bundle now has exactly:
conf/, public/, modules/, precompiled/, framework/, lib/, .classpath,
bin/play-start.sh.

Also added a runtime-instructions message to the playBundle output
that reminds users PLAY_SECRET env var must be provided at runtime,
and certs/ must be supplied separately (mount or generate) if HTTPS
is enabled in application.conf.

Verified against jclaw: bundle no longer contains host.cert, host.key,
or .env. Rest of bundle structure unchanged.

Note: certs/.env.example IS tracked in git (it's the documented
template), so users can see the variable name in their source repo
without it being in the deployment artifact.