Include Copilot identity inputs in the runtime Docker context

The runtime layer must pass Docker context verification before the qualification layer is applied.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.dockerignore

@@ -61,3 +61,9 @@ packages/paperclip-runner/test-fixtures/pi-acp/**
 !packages/paperclip-runner/src/**/*.test.tsx
 
 packages/grok-acp/bin
+
+# The Copilot build-time identity gate reads these sanitized source declarations.
+!packages/paperclip-runner/test/fixtures/copilot-profile-v*-identity.json
+# Images build their pinned Copilot assets instead of copying host binaries.
+/packages/paperclip-runner/provider-assets/
+/server/provider-assets/