Split the monolithic build-image.sh into three scripts: build-image.sh now only builds locally, run-image.sh

runs dist.sh inside that local image via a bind mount, andcupload-image.sh pushes the already-built image.
The Dockerfile also warms the Gradle dependency cache in a throwaway build stage, and pre-installs
the pinned CMake version, so `run-image.sh` doesn't re-download the same Maven dependencies on every run.

dist.sh now strips the -pre+meta suffix before writing package.json's version, since Pebble's build
tooling parses it strictly as X.Y.Z integers and was rejecting suffixed versions.

.dockerignore

@@ -0,0 +1,32 @@
+# Build context for build-image/Dockerfile. The context is the repo root
+# (see build-image.sh) so the Gradle-cache-warming stage can COPY in the
+# companion app's real project files — everything else is excluded to keep
+# the context small and to make sure secrets never reach the Docker daemon.
+.git
+dist
+docs
+versions
+SchwertUndMagieOnPebbleWatchApp
+
+# Companion app: only the Gradle project files are needed (see the
+# gradle-cache-warm stage) — not generated build output or the VICE/nibtools
+# source tarballs (buildVice/buildNibtools are excluded from that stage's
+# gradle invocation, so they're never unpacked there).
+SchwertUndMagieOnPebbleCompanionApp/app/build
+SchwertUndMagieOnPebbleCompanionApp/app/.cxx
+SchwertUndMagieOnPebbleCompanionApp/app/src/main/jni/vice-src
+SchwertUndMagieOnPebbleCompanionApp/app/src/main/jni/vice-libs
+SchwertUndMagieOnPebbleCompanionApp/app/src/main/jni/nibtools-src
+SchwertUndMagieOnPebbleCompanionApp/app/src/main/jni/nibtools-libs
+SchwertUndMagieOnPebbleCompanionApp/res/*.tar.gz
+SchwertUndMagieOnPebbleCompanionApp/.gradle
+SchwertUndMagieOnPebbleCompanionApp/.idea
+SchwertUndMagieOnPebbleCompanionApp/local.properties
+SchwertUndMagieOnPebbleCompanionApp/build
+SchwertUndMagieOnPebbleCompanionApp/captures
+
+# Secrets — must never reach the Docker daemon, even unused.
+registry.env
+**/keystore.properties
+**/*.keystore
+**/*.jks