fix: enforce docker context policy

[pinehill99]

Fixes #3949

Summary

• add .dockerignore rules for local env files, secret material, caches, logs, scratch/debug output, local DB files, and build artifacts
• add scripts/check_docker_context.py so CI fails when required local/debug build-context exclusions are missing
• have the checker flag broad Dockerfile COPY . / ADD . patterns when Dockerfiles are present
• wire the checker into CI before tests and lint
• add regression coverage for the ignore rules, CI wiring, and checker

Scope and overlap

Current overlap checked on 2026-05-25 KST: issue #3949 is open and has one matching open PR, #3950. #3950 adds .dockerignore and a .dockerignore test. This PR intentionally adds the missing executable CI policy gate as well, so the build-context policy fails closed if required exclusions or Dockerfile copy hygiene regress later.

The current repository has no Dockerfiles, so there are no broad Dockerfile copy patterns to rewrite. The checker still enforces that policy for future Dockerfiles.

Validation

• RED: python3 -m pytest tests/test_docker_context_policy.py -q failed before implementation because .dockerignore, CI checker wiring, and scripts/check_docker_context.py were missing
• python3 -m pytest tests/test_docker_context_policy.py -q -> 3 passed
• python3 scripts/check_docker_context.py -> passed and listed excluded local/debug samples
• python3 -m pytest tests/test_docker_context_policy.py tests/test_config.py tests/test_agent_registry.py -q -> 16 passed
• uv run flake8 scripts/check_docker_context.py tests/test_docker_context_policy.py -> passed with pyproject dev-dependencies deprecation warning only
• python3 -m py_compile scripts/check_docker_context.py tests/test_docker_context_policy.py -> passed
• git diff --check -> passed

Full python3 -m pytest tests -q was attempted and stopped on the existing main-branch ImportError: cannot import name 'AgentStatus' from 'src.agent' in tests/test_scheduler.py; this PR does not touch that unrelated suite-health issue.

Risk control

• Duplicate risk is medium because one overlapping open PR (Add dockerignore policy for local artifacts #3950) already targets [ Bounty $3k ] [ Docker ] Exclude local environment files from build context — dockerignore policy #3949.
• No secrets, tokens, private runtime payloads, hidden context, or payout details are included.
• Star-first bounty gate must be confirmed in the submitting pinehill99 Chrome session before PR creation.