The root .dockerignore excludes `app/` (it's sized for the openhuman-core
Dockerfile), which also excludes `app/src-tauri/vendor/tauri-cef`. The CI
image Dockerfile at .github/Dockerfile needs that path to compile the
CEF-aware tauri-cli, so the docker-ci-image workflow fails at the
`COPY app/src-tauri/vendor/tauri-cef /opt/tauri-cef` step.
BuildKit prefers `<dockerfile>.dockerignore` over the root one, so add a
dedicated .github/Dockerfile.dockerignore that keeps the vendored
submodule while still stripping target/, node_modules/, etc. Verified
locally: `docker build -f .github/Dockerfile .` reaches the verify step
with `cargo tauri --version` printing 2.10.1.
