build: s6 tree partition + Dockerfile refactor (1/3)

[Coriou]

Summary

First of three stacked PRs implementing the build & DX overhaul spec at .kiro/specs/build-devx-overhaul/. This PR lands Phases A + B: the s6 service-tree partition and the top-to-bottom Dockerfile refactor.

• Phase A (refactor(s6): partition sdrpp-server into separate overlay tree) — moves the sdrpp-server service definition, its services/contents.d/ and user/contents.d/ registrations out of the canonical docker/overlay/s6-overlay/ tree into a sibling docker/overlay/s6-overlay-sdrpp/ tree. Also deletes the canonical tree's wavekit-api → sdrpp-server hard dep (loosened per design §5; SDR-source reachability is now solely SourceManager's exponential-backoff contract). All 6 file moves recorded as R100 (git history preserved).
• Phase B (3 commits) — Dockerfile rewrite from a 737-line monolith into 20 narrow, named stages: thin base-build, 12 decoder *-build stages each FROM base-build with own apt deps, single-install node-build, then final-base (shared by final/final-core) plus final-sdrpp and final-demod. All 14 upstream decoder/lib refs pinned via ARG <NAME>_REF=<sha> at top of file; checkout pattern is git fetch --depth 1 origin "${REF}" && git checkout --detach FETCH_HEAD. final-core is now a one-line LABEL mode=core stage with zero rm -rf post-hoc surgery on the s6 tree.

The third commit on this PR (build(docker): exclude **/node_modules from build context; restore Req 3.6) fixes a .dockerignore defect that previously required a pnpm config set node-linker hoisted override in node-build to work around two issues:

1. .dockerignore's bare node_modules pattern only matched the context-root directory, so cli/node_modules and packages/*/node_modules entered the build context and clobbered pnpm's fresh symlinks during COPY . ..
2. .npmrc's enable-global-virtual-store=true put the virtual store at ~/.local/share/pnpm/store/v10/links/ which collided with this stage's BuildKit cache mount target.

Fixing both root causes (**/node_modules in dockerignore; --config.enable-global-virtual-store=false on the install) lifted the hoisted-linker override entirely. .npmrc's node-linker=isolated is now the single source of truth (Req 3.6 satisfied strictly).

Properties verified locally (Non-negotiables 7, 8, 9)

• Property 8: docker run --rm wavekit:dev-core find /etc/s6-overlay -iname '*sdrpp*' → empty. ls /usr/local/bin /usr/bin | grep -i sdrpp → empty.
• Property 9: docker run --rm wavekit:dev-core ls /etc/s6-overlay/s6-rc.d/wavekit-api/dependencies.d/ → exactly wavekit-init.
• Property 8 inverse: docker run --rm wavekit:dev find /etc/s6-overlay -name sdrpp-server -type d → exactly one match.
• All 4 final targets (final, final-core, final-sdrpp, final-demod) build clean via docker buildx build --target <t> --load ..
• dsd-fme ncurses linkage on amd64 resolves via Debian's libncurses6 package (the hardcoded COPY --from=dsd-fme-build /usr/lib/x86_64-linux-gnu/libncurses* line was removed entirely per Req 3.13's preferred path).

R2 / R3 notes

• R2 (ncurses): hardcoded x86_64-linux-gnu COPY deleted; verified ldd /usr/local/bin/dsd-fme on amd64 resolves to the runtime-base libncurses6. Debian's libncurses6 is multi-arch so the same install pattern works on arm64; full arm64 build was started but not completed end-to-end (QEMU wall-cost). If arm64 ever shows a missing symbol the fix is a TARGETARCH-conditional COPY.
• R3 (node-linker): see commit 65bc16b body for the full diagnostic chain. Final state: zero pnpm config set calls in the Dockerfile; isolated linker honored from .npmrc.

Test plan

• CI's lint-typecheck-test job green (Node 22 + Corepack)
• CI's docker-build job green on ci-core target (multi-arch; cache-from only on PR — first run will be cold, ~20-30 min, subsequent ~2-5 min once cache seeded)
• Reviewer reads through the new Dockerfile section-by-section against the spec's stage inventory (design §2.1)
• Reviewer confirms docker/overlay/s6-overlay/ is sdrpp-free and docker/overlay/s6-overlay-sdrpp/ contains the 6 expected files
• Reviewer confirms final-core has no rm -rf targeting /etc/s6-overlay/ (mode partition achieved by additive COPY only)

Follow-ons (separate PRs)

• PR 2 (#TBD): compose collapse + buildx bake + Makefile + CI
• PR 3 (#TBD): sdr-host Corepack + docs + dockerignore audit

Spec

• .kiro/specs/build-devx-overhaul/requirements.md — 11 user stories, 51 acceptance criteria
• .kiro/specs/build-devx-overhaul/design.md — 14 anti-patterns retired, 20-stage Dockerfile structure, s6 contract change, 12 correctness properties
• .kiro/specs/build-devx-overhaul/tasks.md — 60-task implementation checklist (A.1–B.2.12 checked off in this PR)