fix(docker): explicit blacklist .dockerignore so cmd/ + pkg/ ship

The previous policy ignored everything via ** and re-included via
!**/*.go. Docker's wildcard handling drops directory entries when
the parent is ignored, so the build context arrived empty of cmd/.
Switch to an explicit blacklist (.git, bin/, .work/, _test.go,
testdata/, docs/, IDE noise) so the whole Go source tree lands.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

.dockerignore

@@ -1,11 +1,29 @@
 # More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
-# Ignore everything by default and re-include only needed files
-**
+#
+# Strategy: ignore everything heavy (.git, build artefacts, dev-stand
+# scratch, IDE files), then keep the Go source tree + module files. We
+# *don't* try to whitelist via `!` from a global `**` — that confuses
+# Docker about directory traversal. Explicit blacklist of known-noisy
+# paths is reviewable and unambiguous.
 
-# Re-include Go source files (but not *_test.go)
-!**/*.go
+# Source-control + build outputs
+.git
+.gitignore
+bin/
+dist/
+.work/
+
+# Tests + scratch we never need in the image
 **/*_test.go
+**/testdata/
+
+# Local notes / docs that would balloon the build context
+.claude/
+docs/
+*.md
 
-# Re-include Go module files
-!go.mod
-!go.sum
+# IDE / editor noise
+.vscode/
+.idea/
+*.swp
+.DS_Store