chore: anchor artifact ignore rules to repo root; block them from Docker image layers

Follow-up to the cherry-picked cleanup: the default.tar.gz profile export
was also carried into published container images by the Dockerfile's
'COPY . .' layer because .dockerignore had no matching pattern. Anchor
the .gitignore rules to repo root (per review feedback on #91712) and
add the same set + /*.tar.gz to .dockerignore so root archives can never
reach an image layer again.

.dockerignore

@@ -106,3 +106,10 @@ plans/
 .gitattributes
 .hadolint.yaml
 .mailmap
+
+# Repo-root debug/export artifacts — must never reach image layers (COPY . .)
+/log.txt
+/sqlite_leak_fix.png
+/*.png.bak
+/default.tar.gz
+/*.tar.gz

.gitignore

@@ -99,10 +99,10 @@ apps/desktop/src/**/*.d.ts
 !apps/desktop/src/vite-env.d.ts
 
 # Repo-root build/debug artifacts that must never be committed
-log.txt
-sqlite_leak_fix.png
-*.png.bak
-default.tar.gz
+/log.txt
+/sqlite_leak_fix.png
+/*.png.bak
+/default.tar.gz
 apps/shared/src/**/*.js
 apps/shared/src/**/*.js.map
 apps/shared/src/**/*.d.ts