fix: honor --exclude and --git when --zip is used (#1097)

ZipDirectory built the archive without consulting the ignoredPaths map
(--git) or the exclusions slice (--exclude). The cli.go post-walk filter
ran after, but it could only match against the resulting .zip filename,
not the contents inside, so excluded paths leaked into the archive.

ZipDirectory now accepts ignoredPaths and exclusions and skips matching
entries during the walk, mirroring the non-zip filtering behaviour.

Closes #1087.