Harden Docker image and narrow build context

[Widthdom]

Summary

• Pin the Docker .NET SDK/runtime-deps base images by multi-arch manifest digest.
• Add a privilege-drop entrypoint that runs cdidx as the /repo owner or the dedicated UID so bind-mounted repositories remain writable without keeping the CLI process as root.
• Narrow the Docker build context, expand .dockerignore, and pass release build metadata through explicit build args/MSBuild overrides instead of relying on .git in the context.
• Add changelog fragments and release workflow tests for the Docker contracts.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ReleaseWorkflowTests" -p:UseSharedCompilation=false
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet build src/CodeIndex/CodeIndex.csproj -c Release -p:CdidxBuildCommitOverride=abc1234 -p:CdidxBuildDateOverride=2026-01-02 -p:CdidxBuildDirtyOverride=clean -p:UseSharedCompilation=false
• dotnet src/CodeIndex/bin/Release/net8.0/cdidx.dll --version --json
• sh -n scripts/docker-entrypoint.sh
• codex exec review --base origin/main --ignore-user-config --ignore-rules --ephemeral reported no blocking or actionable issues.

Docker smoke build was attempted with docker build --target runtime --progress=plain -t cdidx-issue3492-3493-smoke ., but the local Docker daemon is not running (Cannot connect to the Docker daemon at unix:///Users/widom/.docker/run/docker.sock).

Fixes #3492
Fixes #3493