feat(cli): gowdk build --docker emits a Dockerfile next to the one-binary build

[cssbruno]

gowdk build --app --bin already produces a single self-contained server binary, so containerization is mostly a template. Emit it so deploying a GOWDK app is copy-paste.

Scope:

• gowdk build --app --bin --docker writes a Dockerfile: distroless or scratch base, static binary, exposed port from config, non-root user.
• Verify the binary is actually static before choosing scratch (or default to distroless); fail with a diagnostic if not, instead of emitting a broken image recipe.
• Emit .dockerignore.
• Docs: build, docker run, deploy walkthrough.
• Build report lists the emitted artifacts.

Out of scope: compose/K8s manifests, registry publishing, CI, split worker/cron containers (deferred with #114).

Acceptance criteria:

• docker build && docker run serves the example app.
• Non-static binary with scratch base fails with a clear diagnostic.
• Docs walkthrough added.

[cssbruno]

Umbrella plan: #182