fix(agentcore): exclude local-only artifacts from the docker build context

`examples/integrations/agentcore/.dockerignore` covered only cdk.out,
node_modules, __pycache__, *.pyc and the two venv layouts. Everything else a
developer generates in this tree — the Terraform provider cache, tfstate,
terraform.tfvars, config.yaml, docker/.env, generated aws-exports.json, the
Vite build output, amplify-deploy.zip, egg-info — was uploaded to the daemon on
every build.

The context is this directory and three consumers share it: the Terraform
local-exec build in infra-terraform/modules/backend/runtime.tf,
infra-terraform/scripts/build-and-push-image.sh, and the CDK DockerImageAsset in
infra-cdk/lib/backend-stack.ts.

Scope of the harm: both agent Dockerfiles COPY explicit paths and never
`COPY . .`, so none of this reached a published image layer — there is no
credential leak. The cost is context transfer on every build, and CDK asset-hash
churn: DockerImageAsset fingerprints the whole context, so an unrelated local
file change re-tags and re-pushes the image.

Measured with a throwaway `FROM alpine / COPY . /ctx` probe against a context
carrying a realistic set of local-only files (871424 KB .terraform provider
cache plus the rest):

  before: 165 files, 877112 KB in-image, 897.74 MB transferred in 20.7s
  after:  144 files,   2476 KB in-image,  11.26 kB transferred

The 21 dropped paths are exactly the intended ones; nothing else disappeared and
nothing was added. Both agent images then rebuilt clean with --no-cache for
linux/arm64, and `import langgraph_agent` / `import strands_agent` each printed
OK inside the resulting containers. All *.example templates survive.

The file now reaches full parity with the sibling .gitignore, and adds
**/.DS_Store (covered by the repo-root .gitignore).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

examples/integrations/agentcore/.dockerignore

@@ -1,6 +1,48 @@
-**/cdk.out*/
-**/node_modules/
+# Build context for `agents/*/Dockerfile`, which is this directory. Three
+# consumers share it: the Terraform `local-exec` build in
+# infra-terraform/modules/backend/runtime.tf, infra-terraform/scripts/build-and-push-image.sh,
+# and the CDK `DockerImageAsset` in infra-cdk/lib/backend-stack.ts.
+#
+# Both agent Dockerfiles COPY explicit paths and never `COPY . .`, so nothing
+# listed here would have reached a published image layer — this is not about
+# keeping credentials out of the image. What it does buy: local-only trees stop
+# being uploaded to the daemon on every build (a populated
+# infra-terraform/.terraform/ alone is ~850 MB), and they stop feeding the CDK
+# asset fingerprint, which hashes the whole context and so re-tags and re-pushes
+# the image whenever an unrelated local file changes.
+#
+# Keep in sync with .gitignore in this directory.
+
+# Python
 **/__pycache__/
-**/*.pyc
+**/*.py[cod]
+**/*.egg-info/
 **/.venv/
 **/venv/
+**/.uv/
+
+# Node
+**/node_modules/
+**/dist/
+**/build/
+**/.vite/
+
+# CDK
+**/cdk.out*/
+
+# Terraform — .terraform/ is the downloaded provider cache
+**/.terraform/
+**/.terraform.lock.hcl
+**/*.tfstate
+**/*.tfstate.backup
+**/terraform.tfvars
+
+# Local config and generated deploy artifacts (config.yaml and docker/.env hold
+# personal stack values and AWS credentials; the rest are build outputs)
+config.yaml
+docker/.env
+**/aws-exports.json
+**/*.zip
+
+# macOS
+**/.DS_Store