Add container image: two-stage uv build, non-root user, data volume

.dockerignore

@@ -0,0 +1,21 @@
+# Secrets and the local-only launcher: must never reach a layer or the cache.
+.secrets
+.oauth_creds
+start.sh
+AGENTS.md
+
+# VCS and local assistant/tooling scratch
+.git
+.codegraph
+.omp
+
+# Local virtualenv and build/runtime artifacts
+.venv
+dist
+build
+__pycache__
+*.py[oc]
+
+# Runtime state: internal service URLs and per-service header tokens stay on
+# disk and get bind-mounted or volume-mounted into /app/data instead.
+data