.dockerignore excluded the whole web/dist dir, breaking go-builder since
web/embed.go (all:dist) landed (6cbe7e6e): candidate image builds failed
with "pattern all:dist: no matching files found". Re-include the tracked
.gitkeep only; runtime stays disk-dist via web-builder COPY (LookupDist
false -> disk fallback). Verified by a real candidate-images-build run.
Consolidate approved policies and add local lease, document CAS, commit, candidate and environment gates. Preserve conservative recovery and cleanup limits.
*.md was excluding templates/docs from Docker context, so COPY and
go:embed could not see prelim_design.md at /app. Un-ignore those trees
and assert the smoke image can cat the official file.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen