build: exclude local credentials from SenseVoice image context

[LauraGPT]

Summary

• Add a Docker build-context boundary for Git metadata and common local credential files before COPY . /app.
• Disable persisted checkout credentials in both container jobs and trigger the workflow when the ignore rules or context probe change.
• Exercise Docker/BuildKit's actual context matcher with harmless sentinels and verify that required runtime files remain available before the full image build.

Verification

• New regression tests first failed on the missing ignore file and workflow protections.
• 14 container/device contract tests pass locally; shell syntax and git diff checks pass.
• Read-only review found no P1/P2 issues.
• Docker is not installed on the authorized development host, so the real BuildKit context probe and full image build must pass on the exact PR head in CI. This is not a local image/inference acceptance claim.

The GHCR package remains private. This change does not make anonymous pulls work, change visibility, invalidate published tags, or claim that an actual secret leak was observed. The ignore rules cover common names, not arbitrary secrets embedded in source files. Existing runtime behavior is unchanged.