build: make embedded pi images reproducible

.dockerignore

@@ -1,17 +1,26 @@
-# build artefacts & deps
+# Build artefacts, local configuration, and runtime data never enter an image context.
 **/node_modules
 **/.venv
 **/__pycache__
 **/.pytest_cache
 **/dist
 **/*.pyc
-harness/.env
-harness/workspaces/psd.yaml
-deploy/thothii.env
 .git
+.worktrees
 .gitignore
+**/.env
+**/.env.*
+!.env.example
+!deploy/env/*.env.example
+deploy/secrets/
+harness/workspaces/psd.yaml
 **/*.log
 **/.DS_Store
-tht-workspace-psd
+coverage/
+.coverage
+.artifacts/
+data/
+sessions/
+workspace-registry/
 # docs/site (mkdocs build) — non necessari nelle immagini
 docs/superpowers/plans