Add .containerignore: minimal build context

Deny-all with explicit allows (Cargo files, src/, init/, kernel/config).
Previously the full linux submodule was shipped into every build context.

.containerignore

@@ -0,0 +1,10 @@
+# Build context: deny everything, then allow only what the Containerfile needs.
+# Keeps the linux submodule (and example/, .gitea/, README, etc.) out of the build.
+*
+!Cargo.toml
+!Cargo.lock
+!src/
+!src/**
+!init/
+!init/**
+!kernel/config