Keep a submodule's own .git/config out of the build context (closes #88)

The canonical .dockerignore kept out .git/config and the configs under
.git/modules/, but not the config of a submodule that keeps its own .git
directory, so its credential reached the image. Both git patterns now
carry the **/ prefix.

A submodule whose name has a config segment (config, deploy/config,
config/lib) still loses its whole git directory, and Go's version
stamping fails the build. Closing that needs a wildcard re-include,
which makes BuildKit walk every excluded directory on every build, so
the file records it as a KNOWN GAP with the remedy, git submodule add
--name. REPO_POLICIES.md and both checklists say the same.

Model: opus-5-5

.dockerignore

@@ -18,9 +18,16 @@
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 # Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules.
-.git/config
-.git/modules/**/config
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
 
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.