fix(build): restore Windows lint and trim the image build context (#5021)

* fix(windows): restore Windows lint on main

The Windows-only host proxy passed 18 arguments to
ProxyHandle::start_with_bind_addr after #4276 added reserved_destination.
It hosts no OTLP relay, so it passes None.

The network supervisor trust artifact helpers only act on Unix, so
Clippy flags their Result as unnecessary on Windows; allow it there, as
other cfg-dependent helpers do.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

* build(docker): exclude nested build outputs from the image build context

.dockerignore excluded only the top-level target directory, so image
builds from the repository root also sent nested Cargo target
directories (e2e/rust, tests, examples), node_modules, and the .jj
store as context: about 15 GB in a local checkout, which a remote
Podman machine copies on every build. Exclude target and node_modules
at any depth, and .jj. The images copy only prebuilt binaries from
deploy/docker/.build.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

---------

Signed-off-by: Kris Hicks <khicks@nvidia.com>

.dockerignore

@@ -1,9 +1,10 @@
-# Git
+# Version control
 .git
 .gitignore
+.jj
 
 # Rust build artifacts (use BuildKit cache mounts instead)
-target
+**/target
 
 # Python
 __pycache__
@@ -37,3 +38,6 @@ kubeconfig
 *.log
 *.tmp
 .DS_Store
+
+# Node
+**/node_modules

crates/openshell-server/src/network_trust.rs

@@ -413,6 +413,7 @@ fn verify_existing_artifact(path: &Path, normalized: &[u8], digest: &str) -> Res
         })
 }
 
+#[cfg_attr(not(unix), allow(clippy::unnecessary_wraps))]
 fn set_artifact_directory_permissions(path: &Path) -> Result<()> {
     #[cfg(unix)]
     {
@@ -429,6 +430,7 @@ fn set_artifact_directory_permissions(path: &Path) -> Result<()> {
     Ok(())
 }
 
+#[cfg_attr(not(unix), allow(clippy::unnecessary_wraps))]
 fn set_artifact_file_permissions(file: &fs::File, path: &Path) -> Result<()> {
     #[cfg(unix)]
     {
@@ -449,6 +451,7 @@ fn set_artifact_file_permissions(file: &fs::File, path: &Path) -> Result<()> {
 /// Durably record a successful hard-link publication on platforms that permit
 /// syncing directories. This follows the same `File::open(...).sync_all()`
 /// pattern used for other atomic state writes in the repository.
+#[cfg_attr(not(unix), allow(clippy::unnecessary_wraps))]
 fn sync_artifact_directory(path: &Path) -> Result<()> {
     #[cfg(unix)]
     {

crates/openshell-supervisor-network/src/host.rs

@@ -224,6 +224,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result<HostProxyHandle
         None,
         Some(direct_listener_identity),
         None,
+        None,
     )
     .await?;