Keep secrets out of the Docker build context at every depth (closes #29)

The canonical .dockerignore was three lines while the canonical
Dockerfile does `COPY . .`, so a local .env, *.pem or *.key shipped into
the build context and could land in an image layer, invisible to every
git-based check. Copying .gitignore's patterns across is not the repair:
.dockerignore anchors an unprefixed pattern at the context root, so that
form protects only the repository root while reading as solved. Every
depth-independent pattern here carries `**/`, and secret names are
character ranges because matching is case-sensitive and an ALL-CAPS twin
still misses `Server.Key`. Public certificates are deliberately left in
as a legitimate build input. Verified by enumerating a probe image.

Model: opus-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -33,6 +33,15 @@ with your task.
       build step, and `script/cibuild` and `script/docker` build it with
       `--no-cache` — fetch `.dockerignore` from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`
+- [ ] Every depth-independent pattern in `.dockerignore` carries a `**/` prefix,
+      only genuinely root-anchored entries such as `.git` are unprefixed, and
+      `.gitignore`'s patterns have not been transplanted unmodified — the
+      transplanted form leaves `config/.env` and `certs/server.key` in the build
+      context while reading as solved
+- [ ] `.dockerignore` excludes the repo's own host-built artifacts (compiled
+      binaries, test binaries, coverage output), written root-anchored —
+      `/myapp`, never `**/myapp`. An existing repo is where such a binary is
+      likeliest to already be sitting in the build context, invisible to git.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
       push — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`