chore: .dockerignore; drop the committed baseline .sarif

- Root .dockerignore for the root Dockerfile's context: local state (.git,
  .claude worktrees, .venv, .env, caches, reports, *.sarif) and the
  benchmarks/measurements archive (~20 MB of evidence). Kept: everything the
  Dockerfile COPYs, the two 2026-09-13 records ops/smoke_report.py reads
  from /app inside the image, and the harnessx-removal baseline pairs.json
  that learn/sources.toml names as a label source. plane/Dockerfile.runner
  keeps its own ignore file.
- Remove 2026-09-30-harnessx-removal-baseline/scan/report.sarif: tracked
  despite .gitignore's *.sarif, with no counterpart on the candidate side.
  The directory's README says why.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.dockerignore

@@ -0,0 +1,27 @@
+# Build context for the root Dockerfile. The image copies pyproject.toml, README.md, src/, benchmarks/ and
+# ops/frontend-retention/install.py; everything below is either never copied or is evidence the image does not
+# need. plane/Dockerfile.runner has its own plane/Dockerfile.runner.dockerignore.
+
+# Local state, never part of an image (agent worktrees alone run to hundreds of MB; .env holds keys).
+.git
+.claude
+.venv
+.env
+.env.*
+!.env.example
+**/__pycache__
+**/*.pyc
+.mypy_cache
+.ruff_cache
+.pytest_cache
+.openultrasast
+reports
+*.sarif
+
+# The measurement archive (about 20 MB) is evidence, not runtime input. These records stay:
+# ops/smoke_report.py reads the two 2026-09-13 ones from /app inside the image (ops/README.md).
+benchmarks/measurements/*
+!benchmarks/measurements/2026-09-13-delta-comparison-smoke.json
+!benchmarks/measurements/2026-09-13-admission-policy-smoke.json
+# A label source of `ousast learn` (src/openultrasast/learn/sources.toml).
+!benchmarks/measurements/2026-09-30-harnessx-removal-baseline/pairs.json