fix(docker): .dockerignore '*.sh' excluded start.sh, breaking build

Dockerfile COPYs start.sh into the image but the project's .dockerignore
had a bare '*.sh' rule that matched it, so 'docker build' failed at:

  ERROR [10/11] COPY start.sh /app/start.sh:
  CopyIgnoredFile: Attempting to Copy file "start.sh" that is excluded
  by .dockerignore (line 50)

The intent of the rule was to skip user-generated deployment scripts
(which shell-gen produces into deliverables/ and /tmp/). A bare '*.sh'
is too broad: it also catches the project's own start.sh.

Fix: narrow to 'deliverables/*.sh' so only user-generated artifacts are
excluded; start.sh and any other project .sh files are now COPY-able.

.dockerignore does not support !-negation, so the right pattern here
is to make the rule path-specific rather than relying on an allowlist.

Verified:
  - 'docker build -t shell-gen:0.0.1 .' succeeds through all 11 steps
  - container starts, /healthz returns {"generators":50,"ok":true}
  - simulated exclude check: start.sh INCLUDED, deliverables/*.sh
    EXCLUDED, deliverables/*.txt INCLUDED (unchanged)

.dockerignore

@@ -18,8 +18,11 @@ instance/
 *.db
 
 # 交付物 & 生成测试脚本（非源码）
+# NOTE: never use a bare '*.sh' here — that would also exclude the project's
+# own start.sh which the Dockerfile COPYs in. Be specific about which .sh
+# files are user-generated artifacts.
 deliverables/
-*.sh
+deliverables/*.sh
 /tmp/
 
 # 构建中间产物