fix(docker): the images could build green and ship without an entrypoint

[beyondnetPeru]

Found by deploying the Core to kind: the container met CrashLoopBackOff with

Error: Cannot find module '/repo/src/apps/core-api/dist/main'

from an image whose build had exited 0.

Cause

The repository had no .dockerignore. All three service Dockerfiles do COPY src ./src and then build inside the image with npx tsc -b — a composite build, which reads .tsbuildinfo to decide what still needs emitting. The working tree's .tsbuildinfo files rode into the build context, tsc -b concluded the output was already current, and emitted nothing. The image carried a dist/ with most of its files and no main.js.

CI never saw it and could not: CI builds from a fresh checkout, which has no .tsbuildinfo. The inverse of the usual failure — green in CI, broken on every developer machine that had built before.

Fix

Two changes, because the first alone would only close the trigger someone happened to know about.

• .dockerignore excludes **/*.tsbuildinfo (the cause), plus **/dist, **/node_modules and the usual noise. Every runner stage copies --from=builder, so a host dist was never the shipped artifact — letting it into the context only risked a stale build passing as fresh.
• Each Dockerfile asserts its own entrypoint after building, so an image without one fails the build rather than a cluster.

Verification — the assertion was watched failing, not assumed able to

Condition	Result
11 .tsbuildinfo present in the tree	All three images build; each carries its dist/main.js
Assertion pointed at a path that does not exist	Build red, prints its diagnosis
**/*.tsbuildinfo line commented out	Build red — at tsc -b (exit 2), not the assertion, because **/dist is excluded too, so the silent no-op becomes a loud error

Both doors are shut; only one of them was the original.

Guard	Result
ci-runner.mjs governance	✅ 17 scripts
56-validate-docker-workspace-closure	✅ 4 images, 663 sources
gitleaks dir .	✅ exit 0

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 0
• New EN files needing ES translation: 0

Repository Coverage

Metric	Value
Total EN files	526
Total ES files	500
Paired files	0
Coverage	0%

✅ Good: All EN changes have ES counterparts.

---

Generated by GitHub Actions