fix(package): exclude target dir from backups

  Ensure that the target directory is excluded from backups when running
  `cargo package` by creating a CACHEDIR.TAG file. According to the
  CACHEDIR.TAG specification, a tag file in a parent directory excludes
  all subdirectories, so tagging the target directory protects the entire
  tree including the package/ subdirectory and all build artifacts.

  This prevents temporary packaging artifacts from being included in
  Time Machine and other backup systems that respect CACHEDIR.TAG.

  The fix applies to both build_dir (which typically equals target_dir)
  during package creation, and to target_dir when uplifting artifacts
  in workspaces where they differ.

  Updates the test from the previous commit to verify that target/CACHEDIR.TAG
  now exists after running `cargo package`.

  Fixes #16238

Author: SepehrGanji

src/cargo/ops/cargo_package/mod.rs

@@ -161,7 +161,9 @@ fn create_package(
     }
 
     let filename = pkg.package_id().tarball_name();
-    let dir = ws.build_dir().join("package");
+    let build_dir = ws.build_dir();
+    paths::create_dir_all_excluded_from_backups_atomic(build_dir.as_path_unlocked())?;
+    let dir = build_dir.join("package");
     let mut dst = {
         let tmp = format!(".{}", filename);
         dir.open_rw_exclusive_create(&tmp, gctx, "package scratch space")?
@@ -225,6 +227,7 @@ pub fn package(ws: &Workspace<'_>, opts: &PackageOpts<'_>) -> CargoResult<Vec<Fi
         result.extend(packaged.into_iter().map(|(_, _, src)| src));
     } else {
         // Uplifting artifacts
+        paths::create_dir_all_excluded_from_backups_atomic(target_dir.as_path_unlocked())?;
         let artifact_dir = target_dir.join("package");
         for (pkg, _, src) in packaged {
             let filename = pkg.package_id().tarball_name();

tests/testsuite/package.rs

@@ -7810,8 +7810,7 @@ fn publish_to_alt_registry_warns() {
 
 #[cargo_test]
 fn package_dir_not_excluded_from_backups() {
-    // This test documents the current behavior where target is NOT excluded from backups.
-    // After the fix, this test will be updated to verify that CACHEDIR.TAG exists.
+    // Verify that target is excluded from backups by checking for CACHEDIR.TAG
     let p = project()
         .file("src/main.rs", r#"fn main() { println!("hello"); }"#)
         .build();
@@ -7830,11 +7829,11 @@ fn package_dir_not_excluded_from_backups() {
 "#]])
         .run();
 
-    // Currently, CACHEDIR.TAG does NOT exist in target/
+    // Verify CACHEDIR.TAG exists in target (which excludes target/ and all subdirectories)
     let cachedir_tag = p.root().join("target/CACHEDIR.TAG");
     assert!(
-        !cachedir_tag.exists(),
-        "CACHEDIR.TAG should not exist (documenting current buggy behavior)"
+        cachedir_tag.exists(),
+        "CACHEDIR.TAG should exist in target directory to exclude it from backups"
     );
 }