the_permalink() will echo the content immediately. You can’t use it for string concatenation. What is happening is that your permalink gets echoed by the_permalink() before the string is finished building, so the permalink ends up in the wrong place.
What you need instead is get_the_permalink().
Side note: Because PHP’s echo will take multiple parameters, separating your strings with a comma (argument delimiter) rather that a period (concatenation operator) should also work:
echo '
<h2>' , get_the_title() , '</h2>
<p>' , get_the_excerpt() , '</p>
<p>' , get_the_post_thumbnail() , '</p>
<a href="' , the_permalink() , '">' , get_the_title() , '</a>';
If you do it that way, every component of the string echos immediately. You are never concatenating a string so things never get out of order.
As far as excluding pages, you want posts__in not include but that requires, or limits the query to, the specified post IDs. To exclude, you want posts__not_in. And don’t use the “query var” syntax. It will trip you up. Use an array like this from example from the Codex:
$query = new WP_Query(
array(
'post_type' => 'post',
'post__not_in' => array( 2, 5, 12, 14, 20 )
)
);