Keep secrets out of the Docker build context at every depth (closes #29)

The canonical .dockerignore was three lines while the canonical
Dockerfile does `COPY . .`, so a local .env, *.pem or *.key shipped into
the build context and could land in an image layer, invisible to every
git-based check. Copying .gitignore's patterns across is not the repair:
.dockerignore anchors an unprefixed pattern at the context root, so that
form protects only the repository root while reading as solved. Every
depth-independent pattern here carries `**/`, and secret names are
character ranges because matching is case-sensitive and an ALL-CAPS twin
still misses `Server.Key`. Public certificates are deliberately left in
as a legitimate build input. Verified by enumerating a probe image.

Model: opus-5

TODO.md

@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-09-08: Closed the secret exposure in the canonical `.dockerignore`: a
+  local `.env`, `*.pem` or `*.key` was reaching the build context under
+  `COPY . .`, invisible to every git-based check. The patterns are now written
+  to `.dockerignore`'s own semantics — `**/`-prefixed so they hold at every
+  depth, case-folded with character ranges — and `REPO_POLICIES.md` requires
+  verifying by enumerating the image rather than by reading the file.
 - 2026-09-08: Made a pinned tool in `script/bootstrap` actually reach the host.
   `REPO_POLICIES.md` now requires comparing the installed version against the
   pin rather than testing `PATH` presence, and re-resolving the binary through