build: configured docker build pipelines for cargo native addons

- Switched Docker images to build native addons via cargo/napi-rs (`OMP_NATIVE_BUILD_BACKEND=cargo`) instead of Bazel.
- Updated Cargo.toml workspace members explicitly to prevent loading errors from stale directories under crates/.
- Added depth-agnostic patterns to .dockerignore files to exclude nested build outputs from Docker build contexts.
- Added OMP_NATIVE_CARGO_PROFILE environment variable to support configuring cargo profiles for addon builds.

Dockerfile

@@ -25,33 +25,41 @@
 ARG BUN_VERSION=1.3.14
 
 ############################
-# 1) natives-builder — Rust + Bun → pi_natives.linux-<arch>.node
+# 1) natives-builder — Rust + Bun → pi_natives.linux-<arch>.node (local cargo)
 ############################
 FROM rust:1.86-slim-bookworm AS natives-builder
 
 ARG BUN_VERSION
+
+# The addon is built with cargo/napi-rs (OMP_NATIVE_BUILD_BACKEND=cargo)
+# instead of Bazel: the image is one fixed host target, so Bazel's hermetic
+# cross toolchains and crate_universe splice buy nothing while costing a
+# bazelisk download plus a full analysis phase on every build. `ci` profile =
+# release codegen, thin LTO, stripped.
 ENV BUN_INSTALL=/opt/bun \
     PATH=/opt/bun/bin:/usr/local/cargo/bin:/usr/local/bin:/usr/bin:/bin \
-    CARGO_TERM_COLOR=never
+    CARGO_TERM_COLOR=never \
+    OMP_NATIVE_BUILD_BACKEND=cargo \
+    OMP_NATIVE_CARGO_PROFILE=ci
 
 # clang/libclang-dev: bindgen for pipewire-sys/libspa-sys (Linux desktop capture);
 # cmake/make/ninja-build: audiopus_sys builds bundled libopus via CMake.
-# bazelisk: hermetic bazel launcher for the native addon build (17.1.5+).
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         curl ca-certificates pkg-config libssl-dev unzip git \
         clang libclang-dev cmake make ninja-build \
-    && rm -rf /var/lib/apt/lists/* \
-    && curl -fsSL -o /usr/local/bin/bazelisk \
-        "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-$(dpkg --print-architecture)" \
-    && chmod +x /usr/local/bin/bazelisk \
-    && ln -s /usr/local/bin/bazelisk /usr/local/bin/bazel
+    && rm -rf /var/lib/apt/lists/*
 
 RUN curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" \
     && /opt/bun/bin/bun --version
 
 WORKDIR /pi
 
+# Layer 0 — the pinned nightly toolchain. Its own layer so a source or manifest
+# edit never re-downloads ~5 rustup components.
+COPY rust-toolchain.toml /pi/
+RUN rustup show
+
 # Layer 1 — manifests + lockfiles only. Source edits under packages/*/src and
 # crates/*/src won't bust `bun install` below. `--parents` preserves the
 # matched path under /pi/ (requires syntax 1.7-labs).
@@ -75,13 +83,12 @@ RUN bun install --frozen-lockfile --ignore-scripts
 COPY . /pi/
 
 # Layer 4 — compile pi-natives to a Linux N-API addon. Persistent caches keep
-# repeat builds incremental: cargo's package index + git-deps + the workspace
-# target dir.
-RUN --mount=type=cache,target=/root/.cargo/registry \
-    --mount=type=cache,target=/root/.cargo/git \
+# repeat builds incremental: cargo's package index + git-deps (CARGO_HOME is
+# /usr/local/cargo in the rust image, not ~/.cargo) + the workspace target dir.
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
     --mount=type=cache,target=/pi/target \
     set -eux; \
-    rustup show; \
     bun --cwd=packages/natives run build; \
     mkdir -p /out; \
     cp packages/natives/native/pi_natives.linux-*.node /out/