Ensure manifest.yml & stackato.yml aren't exposed in public/ #closes 4 (take 2)