fix: give the image build the files its tests read

The suite gained three tests that assert on .github/workflows — the
freshness-cache restore, the per-attempt cache key and the rebase-and-
retry push, all defects that live in YAML and fail silently. But
.dockerignore excluded .github, so those three tests failed inside the
image build and took the whole build down with them.

Put .github in the build context. It reaches the build stage only; the
runtime stage still copies nothing but public/ and serve.ts, and the
image is unchanged (verified: /app holds public and serve.ts, nothing
else).

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.dockerignore

@@ -1,5 +1,7 @@
 .git
-.github
+# .github is NOT ignored: the test suite asserts on the refresh workflows, and
+# the image build runs that suite as its gate. It reaches the build stage only —
+# the runtime stage copies nothing but public/ and serve.ts.
 .gitlab-ci.yml
 node_modules
 public

Dockerfile

@@ -24,6 +24,10 @@ COPY fixtures ./fixtures
 # served fresh, with nothing to say why.
 COPY snapshots ./snapshots
 COPY test ./test
+# The suite asserts on the refresh workflows — three defects that live in YAML
+# and fail silently — so the files have to be here for `bun test` below to mean
+# the same thing it means in CI.
+COPY .github ./.github
 
 # Fail the image on a type error or a failing test rather than shipping it.
 RUN bun run typecheck && bun test