How come .forceignore is being applied to force:source:deploy?

We have a permission set that we explicitly deploy as part of our scratch org build process using a command like:

sfdx force:source:deploy -pforce-app/main/default/permissionsets/Manage_Encryption.permissionset-meta.xml -u<alias>

We don’t want this to be deployed again when we push the remainder of the source tree. A recent change (likely part of Summer 20 or a recent sfdx version) broke our build, complaining about a conflict between the previously deployed permission set and the force:source:push we do.

Thus we are looking to suppress inclusion of the file in the push and so turned to the .forceignore. However, if we add an entry into the .forceignore file the above force:source:deploy command fails.

The entry we added was:

force-app/main/default/permissionsets/Manage_Encryption.permissionset-meta.xml

The error we get is:

ERROR running force:source:deploy: The PermissionSet named Manage_Encryption was not found in the workspace

According to the documentation:

The .forceignore file excludes files when running the source commands: force:source:convert, force:source:push, force:source:pull, and force:source:status.

I.e. it doesn’t list force:source:deploy so we didn’t expect this problem.

Anyone else seen this behaviour? Did you find a workaround? (We are thinking to move the file into a different "package directory" to resolve this issue but wondered if there was a quick-win.)