default.nix: filter .git and unknown files in src