Leave out of the build context what the app's .dockerignore names (closes #274)

Docker does not apply .dockerignore to a build context sent as a tar,
so upaas sent every file in the clone. The build now reads the ignore
file as docker build does, with the ignorefile reader of
moby/patternmatcher: <Dockerfile>.dockerignore next to the Dockerfile
if there is one, otherwise .dockerignore at the root. As Docker does,
the Dockerfile path is read as a path inside the clone, and when a
Dockerfile named Dockerfile is missing, a lowercase dockerfile next to
it is used instead. As the docker command line does, the Dockerfile and
.dockerignore are never left out. The ignore file is read through
os.Root. An ignore file that cannot be read, or a malformed pattern,
fails the build.

Model: opus-5-5

TODO.md

@@ -20,6 +20,13 @@ regress.
 
 # Completed Steps
 
+- 2026-10-03: An app's build context leaves out the files its `.dockerignore`
+  names, such as `.git/config`, as `docker build` does; before, every file in
+  the clone was sent. An ignore file next to the Dockerfile,
+  `<Dockerfile>.dockerignore`, is read instead when there is one. The Dockerfile
+  and `.dockerignore` are always sent. An ignore file that cannot be read, or
+  holds a pattern Docker rejects, fails the build (#274).
+
 - 2026-10-03: `make test`, and so `docker build .`, fits a machine with 4 GiB of
   memory: tests hash passwords with 1 MiB instead of upaasd's 64 MiB, so
   `GOMAXPROCS=4 make test` peaks at about 1.4 GiB instead of 2.7 GiB. upaasd