dockerignore: exclude local analysis scratch from the build context

Defence in depth. The Dockerfile only COPYs explicit paths (vendor/, docker/,
scripts/setup-ida-mcp.sh, assets/), so nothing else in the working tree can
reach an image - but if a future COPY widens, ctf/ and targets/ must not be
sweepable.

.dockerignore

@@ -13,6 +13,7 @@ vendor/hopper-state/*
 !vendor/.gitkeep
 work/
 targets/
+ctf/
 config/ida/*.hexlic
 config/ida-mcp.json
 config/rea.env