fix(docker): build fabro-cli inside rust:1-bookworm for local image

The host cargo build on macOS produced a Mach-O binary that the
Linux runtime image refused with "Exec format error". Run the
compile in rust:1-bookworm so the output matches the target
platform, and cache the registry plus target dir in named volumes
for incremental rebuilds. Also gitignore docker-context/ since it
is regenerated on every build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bin/dev/docker-build.sh

@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
 # Build a local fabro Docker image from the current working tree.
 #
-# The release workflow uses prebuilt release tarballs, but for local development
-# we cargo build first and stage the binary where the Dockerfile expects it.
+# The release workflow uses prebuilt release tarballs. For local iteration we
+# compile inside rust:1-bookworm so the binary is a Linux ELF that matches the
+# runtime image, regardless of host OS. Cargo registry and target dir are
+# cached in named volumes so subsequent runs are incremental.
 
 set -euo pipefail
 
@@ -17,11 +19,23 @@ case "$(uname -m)" in
     ;;
 esac
 
-echo "Building fabro (release, host arch: $arch)..."
-cargo build --release -p fabro-cli
+echo "Building fabro-cli inside rust:1-bookworm (target arch: linux/$arch)..."
+docker run --rm \
+  -v "$PWD:/src" \
+  -v fabro-docker-cargo-registry:/usr/local/cargo/registry \
+  -v fabro-docker-cargo-target:/target \
+  -w /src \
+  -e CARGO_TARGET_DIR=/target \
+  rust:1-bookworm \
+  cargo build --release -p fabro-cli
 
+echo "Extracting binary from builder cache..."
 mkdir -p "docker-context/$arch"
-cp target/release/fabro "docker-context/$arch/fabro"
+docker run --rm \
+  -v fabro-docker-cargo-target:/target \
+  -v "$PWD/docker-context/$arch:/out" \
+  rust:1-bookworm \
+  cp /target/release/fabro /out/fabro
 
 echo "Building Docker image..."
 docker build -t fabro .