[EPIC] Dockerfile/Makefile hardening audit (F2 round)

gh issue create --title "[EPIC] Dockerfile/Makefile hardening audit (F2 round)" --label "epic,audit" --body "## EPIC: Dockerfile/Makefile hardening audit (F2 round)

Source: F2 audit round, 2026-09-03. This EPIC aggregates the 8 findings from the Dockerfile/Makefile audit (1 HIGH, 3 MEDIUM, 4 LOW).

The HIGH is the BuildKit requirement not being enforced by Makefile or documented for new contributors. The MEDIUMs are layer / dead-code cleanup. The LOWs are OCI metadata and .dockerignore hygiene.

### HIGH

- [ ] #156 Dockerfile.test-server requires BuildKit but Makefile uses plain 'docker build' (existing; F2 added detail)

### MEDIUM

- [ ] #203 Dockerfile/Makefile M-1 — three RUN layers could be combined
- [ ] #204 Dockerfile/Makefile M-2 — two COPY layers could be combined
- [ ] #205 Dockerfile/Makefile M-3 — WORKDIR /app is dead code

### LOW

- [ ] #206 Dockerfile/Makefile L-1 — .dockerignore does not exclude .worktrees/
- [ ] #207 Dockerfile/Makefile L-2 — Dockerfile missing OCI labels
- [ ] #208 Dockerfile/Makefile L-3 — mkdir -p /home/lftp + chown -R redundant with adduser
- [ ] #209 Dockerfile/Makefile L-4 — LICENSE/README.md copied but unused by entrypoint

## Suggested resolution order

1. Land H-1 fix in v2.11.3 (Makefile -> Buildx) — gates future test-server improvements.
2. Batch MEDIUMs + LOWs into a build-cleanup release.

## Source

F2 audit 2026-09-03 (Dockerfile/Makefile audit). Reporter: subagent-pekodbj7."