fix: give the image build the files its tests read

The suite gained three tests that assert on .github/workflows — the
freshness-cache restore, the per-attempt cache key and the rebase-and-
retry push, all defects that live in YAML and fail silently. But
.dockerignore excluded .github, so those three tests failed inside the
image build and took the whole build down with them.

Put .github in the build context. It reaches the build stage only; the
runtime stage still copies nothing but public/ and serve.ts, and the
image is unchanged (verified: /app holds public and serve.ts, nothing
else).

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.dockerignore

@@ -1,5 +1,7 @@
 .git
-.github
+# .github is NOT ignored: the test suite asserts on the refresh workflows, and
+# the image build runs that suite as its gate. It reaches the build stage only —
+# the runtime stage copies nothing but public/ and serve.ts.
 .gitlab-ci.yml
 node_modules
 public