build: configured docker build pipelines for cargo native addons

- Switched Docker images to build native addons via cargo/napi-rs (`OMP_NATIVE_BUILD_BACKEND=cargo`) instead of Bazel.
- Updated Cargo.toml workspace members explicitly to prevent loading errors from stale directories under crates/.
- Added depth-agnostic patterns to .dockerignore files to exclude nested build outputs from Docker build contexts.
- Added OMP_NATIVE_CARGO_PROFILE environment variable to support configuring cargo profiles for addon builds.

packages/natives/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+### Changed
+
+- Docker images (`Dockerfile`, `scripts/install-tests/*.dockerfile`) build the native addon through the cargo/napi-rs backend (`OMP_NATIVE_BUILD_BACKEND=cargo`) instead of Bazel: a single fixed host target gains nothing from hermetic cross toolchains, and none of those images shipped bazelisk. `OMP_NATIVE_CARGO_PROFILE` picks the profile for that path (images use `ci`, local default stays `local`).
+
+### Fixed
+
+- Fixed the root Cargo workspace failing to load when a stale directory exists under `crates/` — e.g. a deleted crate whose directory survived `git reset --hard`. `members` no longer globs `crates/pi-*`, so a directory without a `Cargo.toml` can no longer break every cargo and Bazel build.
+- Fixed Docker build contexts shipping nested build output: `.dockerignore` patterns are anchored at the context root, so bare `target/` and `dist/` matched neither `go-port/*/target` (~1.4 GB) nor `packages/*/dist` (~600 MB).
+
 ## [17.3.1] - 2026-08-13
 
 ### Fixed

packages/natives/scripts/build-bindings.ts

@@ -1,9 +1,12 @@
 /**
- * Dev-only napi build that regenerates the TypeScript bindings
- * (native/index.d.ts) and the runtime enum exports. Shipping addons are built
- * by Bazel (`bun run build` → scripts/bazel-natives.ts); run this
- * (`bun run build:bindings`) only when the Rust API changes its exported
- * typedefs. Host target only, local cargo profile — no cross-compilation.
+ * Local napi build: regenerates the TypeScript bindings (native/index.d.ts)
+ * and the runtime enum exports, then installs the host addon. Release addons
+ * come from Bazel (`bun run build` → scripts/bazel-natives.ts); this path also
+ * serves hosts Bazel cannot run on (Windows, the Docker image) via
+ * `OMP_NATIVE_BUILD_BACKEND=cargo`. Host target only — no cross-compilation.
+ *
+ * `OMP_NATIVE_CARGO_PROFILE` selects the cargo profile (default `local`:
+ * incremental, unstripped). Image builds set `ci` for a stripped addon.
  */
 
 import * as fsSync from "node:fs";
@@ -203,6 +206,10 @@ if (!napiBinEntry) {
 }
 const napiBin = path.join(path.dirname(napiManifestPath), napiBinEntry);
 
+// Profiles live in the root Cargo.toml; `local` trades size for iteration
+// speed, `ci` strips and drops incremental state.
+const cargoProfile = Bun.env.OMP_NATIVE_CARGO_PROFILE?.trim() || "local";
+
 const napiArgs = [
 	"build",
 	"--manifest-path",
@@ -216,7 +223,7 @@ const napiArgs = [
 	"-o",
 	buildOutputDir,
 	"--profile",
-	"local",
+	cargoProfile,
 ];
 
 // napi-rs / cargo route much failure detail to stdout (e.g. `cargo metadata`