Ensure manifest.yml & stackato.yml aren't exposed in public/ #closes 4