fix(docker): install bazelisk in natives-builder stage

The bazel migration (8facd237d) switched the native addon build to
bazel-natives.ts which requires bazelisk/bazel on PATH, but the
Dockerfile was never updated to install it. Also exclude bazel-*
output symlinks from the docker build context.

Dockerfile

@@ -36,11 +36,16 @@ ENV BUN_INSTALL=/opt/bun \
 
 # clang/libclang-dev: bindgen for maudio-sys (miniaudio); cmake/make/ninja-build:
 # audiopus_sys builds bundled libopus via CMake (native audio stack, 17.1.1+).
+# bazelisk: hermetic bazel launcher for the native addon build (17.1.5+).
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         curl ca-certificates pkg-config libssl-dev unzip git \
         clang libclang-dev cmake make ninja-build \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && curl -fsSL -o /usr/local/bin/bazelisk \
+        "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-$(dpkg --print-architecture)" \
+    && chmod +x /usr/local/bin/bazelisk \
+    && ln -s /usr/local/bin/bazelisk /usr/local/bin/bazel
 
 RUN curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" \
     && /opt/bun/bin/bun --version

Dockerfile.dockerignore

@@ -3,8 +3,9 @@
 # Dockerfile.robomp.dockerignore alongside.
 
 # Heavy build outputs — must never reach the build context. `target/` alone is
-# >100 GB on a dev machine.
+# >100 GB on a dev machine; `bazel-*` symlinks point at the bazel output base.
 target/
+bazel-*
 **/node_modules
 dist/
 runs/