feat: support excluding task namespaces

[arturict]

Summary

• treat an excluded task name as a namespace for tasks below it
• preserve exact task exclusions and avoid matching similarly prefixed names
• document namespace exclusions in the guide and schema reference

Closes #2300.

Validation

• go test ./... -run TestIncludesWithExclude -count=1
• git diff --check

I also ran go test ./.... The affected tests pass, while unrelated tests that
require Unix commands or symlink behavior fail on my Windows environment.

AI usage

I used an AI coding assistant to help inspect the repository, implement the
change, and run the checks. I reviewed the diff and verified the exact-task,
namespace-task, and similarly-prefixed-task cases locally.

• I have read and followed the Contribution Guide