fix: address CodeRabbit review - save story before git inspection

- Move story file save BEFORE git commands so its changes appear in working tree
- Add git diff --cached --name-only to capture staged files alongside unstaged
- Add _bmad/ and _bmad-output/ exclusion filtering to all git inspection steps
- Clarify File List update uses full-replace semantics (not append)
- Add list structure placeholder to story template
- Apply consistent three-command git set across Step 8, Step 9, and DoD checklist

src/bmm/workflows/4-implementation/create-story/template.md

@@ -48,5 +48,13 @@ so that {{benefit}}.
 
 ### File List
 
-<!-- Use `git diff --name-only` and `git status --porcelain` to capture ALL changed files,
+<!-- 
-     including infrastructure side-effects: lock files, this story file, sprint-status.yaml -->
+  Populate using git commands after each task:
+    git diff --name-only
+    git diff --cached --name-only
+    git status --porcelain
+  Include infrastructure side-effects (lock files, sprint-status.yaml, story file).
+  Exclude: _bmad/, _bmad-output/ directories.
+-->
+
+- (list files here, one per line)

src/bmm/workflows/4-implementation/dev-story/instructions.xml

@@ -296,10 +296,12 @@
     <!-- ONLY MARK COMPLETE IF ALL VALIDATION PASS -->
     <check if="ALL validation gates pass AND tests ACTUALLY exist and pass">
       <action>ONLY THEN mark the task (and subtasks) checkbox with [x]</action>
-      <action>Run `git diff --name-only` and `git status --porcelain` to discover ALL changed files (including infrastructure
-        side-effects like lock files, the story file itself, and sprint-status.yaml)</action>
-      <action>Update File List section from git output with ALL new, modified, or deleted files (paths relative to repo root)</action>
       <action>Add completion notes to Dev Agent Record summarizing what was ACTUALLY implemented and tested</action>
+      <action>Save the story file NOW so its own changes appear in the working tree</action>
+      <action>Run `git diff --name-only`, `git diff --cached --name-only`, and `git status --porcelain` to discover ALL changed files
+        (including infrastructure side-effects like lock files, the story file itself, and sprint-status.yaml)</action>
+      <action>Filter out paths under `_bmad/` and `_bmad-output/` directories from the git output</action>
+      <action>REPLACE the File List section entirely with the filtered results: ALL new, modified, or deleted files (paths relative to repo root, one per line)</action>
     </check>
 
     <check if="ANY validation fails">
@@ -325,7 +327,9 @@
   <step n="9" goal="Story completion and mark for review" tag="sprint-status">
     <action>Verify ALL tasks and subtasks are marked [x] (re-scan the story document now)</action>
     <action>Run the full regression suite (do not skip)</action>
-    <action>Run `git diff --name-only` and `git status --porcelain` to get actual changed files; confirm File List matches git output</action>
+    <action>Save the story file before inspecting the working tree</action>
+    <action>Run `git diff --name-only`, `git diff --cached --name-only`, and `git status --porcelain` to get actual changed files
+      (excluding paths under `_bmad/` and `_bmad-output/`); verify File List contains ALL reported paths and auto-append any missing entries</action>
     <action>Execute enhanced definition-of-done validation</action>
     <action>Update the story Status to: "review"</action>
 
@@ -338,7 +342,7 @@
       - End-to-end tests for critical flows added when story demands them
       - All tests pass (no regressions, new tests successful)
       - Code quality checks pass (linting, static analysis if configured)
-      - File List matches all git-reported changes - run `git diff --name-only` and `git status --porcelain` to verify
+      - File List matches all git-reported changes - run `git diff --name-only`, `git diff --cached --name-only`, and `git status --porcelain` to verify (exclude `_bmad/`, `_bmad-output/`)
       - Dev Agent Record contains implementation notes
       - Change Log includes summary of changes
       - Only permitted story sections were modified