chore: anchor artifact ignore rules to repo root; block them from Docker image layers

Follow-up to the cherry-picked cleanup: the default.tar.gz profile export
was also carried into published container images by the Dockerfile's
'COPY . .' layer because .dockerignore had no matching pattern. Anchor
the .gitignore rules to repo root (per review feedback on #91712) and
add the same set + /*.tar.gz to .dockerignore so root archives can never
reach an image layer again.

.dockerignore

@@ -106,3 +106,10 @@ plans/
 .gitattributes
 .hadolint.yaml
 .mailmap
+
+# Repo-root debug/export artifacts — must never reach image layers (COPY . .)
+/log.txt
+/sqlite_leak_fix.png
+/*.png.bak
+/default.tar.gz
+/*.tar.gz