chore(container): audit and reorganize .dockerignore (#1851)

[josecelano]

Summary

Reorganizes .dockerignore into clearly labeled sections and adds several missing exclusions, reducing the Docker build context and narrowing the cache-invalidation surface.

What Changed

.dockerignore reorganized into labeled sections:

• ## Runtime config templates — share/
• ## Documentation — docs/, README.md, SECURITY.md, LICENSE, NOTICE
• ## Developer tooling — .github/, contrib/dev-tools/ (with !contrib/dev-tools/su-exec/ negation to retain the su-exec source needed by the container build)
• ## CI / repo metadata — .git/, target/

New exclusions added:

• SECURITY.md, LICENSE — legal/documentation files not needed in the image
• packages/AGENTS.md, src/AGENTS.md — AI agent instruction files
• contrib/dev-tools/ (entire directory, except su-exec/) — benchmarks, scripts, and analysis tooling that previously slipped through

Measured Impact

Metric	Before	After	Delta
Docker build context	4.75 MB	4.64 MB	−110 kB (−2.3%)

Cache invalidation surface reduced: changes inside contrib/dev-tools/ (workflow benchmarks, analysis scripts, etc.) no longer trigger a source-stage cache miss.

Files Changed

• .dockerignore — reorganized and extended
• docs/issues/open/1851-1840-workflow-performance-dockerignore-audit/ISSUE.md — issue spec
• docs/issues/open/1840-improve-pr-workflow-performance-epic/EPIC.md — EPIC progress update (subissues created/linked, PR docs(issues): draft sub-issue specs for EPIC #1840 workflow performance improvements #1855 logged)

Validation

• docker build executed before and after; build context size measured with --progress=plain output
• docker build --no-cache confirmed su-exec/ source is still present in the image (required for su-exec binary compilation)
• All pre-push checks passed (fmt, clippy, tests)

Closes #1851

[Copilot]

Pull request overview

Reorganizes .dockerignore into clearly labeled sections and adds new exclusions (SECURITY.md, LICENSE, packages/AGENTS.md, src/AGENTS.md, and contrib/dev-tools/ except su-exec/), reducing build context by ~110 kB and narrowing cache-invalidation surface. Spec and EPIC docs are updated to reflect implementation status.

Changes:

• Reorganize .dockerignore into labeled sections with a header documenting intentionally-included paths.
• Exclude additional dev/legal/docs files; keep contrib/dev-tools/su-exec/ via re-include rule.
• Update issue spec and EPIC progress logs to mark relevant tasks/ACs as DONE.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.dockerignore	Reorganized into sections; added new exclusions; documented intentional inclusions.
docs/issues/open/1851-1840-workflow-performance-dockerignore-audit/ISSUE.md	Marks T1–T5 and AC1–AC3/AC5/AC6 as DONE; records measured context size delta.
docs/issues/open/1840-improve-pr-workflow-performance-epic/EPIC.md	Marks "subissues created and linked" as done; appends progress log entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.80%. Comparing base (f2a4ba4) to head (1043b49).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #1858   +/-   ##
========================================
  Coverage    77.80%   77.80%           
========================================
  Files          380      380           
  Lines        28648    28648           
  Branches     28648    28648           
========================================
  Hits         22290    22290           
  Misses        6052     6052           
  Partials       306      306           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[josecelano]

ACK 1043b49