Anchor release tarball excludes to repo root

`tar --exclude` was matching patterns globally (e.g. `--exclude=benches` also matched `admin/backend/api/v1/benches/`), shipping incomplete tarballs.