Leave out of the build context what the app's .dockerignore names (closes #274)

Docker does not apply .dockerignore to a build context sent as a tar,
so upaas sent every file in the clone. The build now reads the ignore
file as docker build does, <Dockerfile>.dockerignore next to the
Dockerfile if there is one, otherwise .dockerignore at the root, with
the ignorefile reader of moby/patternmatcher, and passes its patterns
as exclude patterns. As the docker command line does, the Dockerfile
and .dockerignore are never left out. An ignore file that cannot be
read, or a malformed pattern, fails the build.

Model: opus-5-5

TODO.md

@@ -20,6 +20,13 @@ regress.
 
 # Completed Steps
 
+- 2026-10-03: An app's build context leaves out the files its `.dockerignore`
+  names, such as `.git/config`, as `docker build` does; before, every file in
+  the clone was sent. An ignore file next to the Dockerfile,
+  `<Dockerfile>.dockerignore`, is read instead when there is one. The Dockerfile
+  and `.dockerignore` are always sent. An ignore file that cannot be read, or
+  holds a pattern Docker rejects, fails the build (#274).
+
 - 2026-10-02: In a window too narrow for the top bar, such as 390 px, the New
   App and Logout buttons move to a second row instead of running into "by
   @sneak"; the bar keeps a gap between its two sides at every width (#272).