fix(packaging): restore nix desktop and docker builds

Generate frontend icons from the shared source artwork during each build.
Keep the locked icon dependencies out of the application runtime.

Nix needs setuptools and CFFI to build the locked python-olm source.
Its offline npm manifest must omit semver overrides because direct
package specs become local tarball paths. Preserve the repository
manifest and lockfile.

Docker must use the PM interpreter rather than a second Python under
/root. Install the application into its venv explicitly, use the image
compiler, and make package facts readable by the runtime user.

Verified:
- nix build .#desktop and frontend-icons/package-contents/cli-commands
- Packaged Electron PTY spawn and libolm encryption roundtrip
- ARM Linux and macOS desktop evaluation, not native builds
- Docker linux/amd64 build and 8 focused runtime tests

The full test suite was not run. Leave llama integration unchanged.

.dockerignore

@@ -84,8 +84,16 @@ tests/
 website/
 docs/
 
-# Assets only used by the GitHub README
+# Keep the source artwork needed by web's icon-generation prebuild.
 assets/
+!assets/
+assets/*
+!assets/nous-girl-black.svg
+!assets/nous-girl-white.svg
+!assets/backgrounds/
+assets/backgrounds/*
+!assets/backgrounds/squircle-light.svg
+!assets/backgrounds/squircle-dark.svg
 infographic/
 
 # Plugin-level docs (hermes-achievements ships docs/ but the runtime doesn't read them)