fix(ci): repo-root build context for notebooks+zotero, refresh pkg-manifest

Two scheduled pipelines were failing on every run and spamming Gitea issues
(30 open): 26 from Package Supply Chain (daily), 4 from Harden (weekly).

- Package Supply Chain: pkg-manifest.json was stale — markdown-it-py and
  mdit-py-plugins were in source but not the manifest, failing "Check
  manifest freshness" and "Drift detection". Regenerated via pkg_inventory.py.

- Harden: "Build notebooks" failed with `"/infra/marimo/theme": not found`.
  notebooks.Dockerfile COPYs infra/marimo/theme (a repo-root path), but
  stack.toml built it with context notebooks/. The .dockerignore was already
  set up for repo-root context (it carves out infra/marimo/theme/**); the
  per-image context was a stale leftover from the notebooks content/config
  split. Switched notebooks and zotero to context "." like docs/api.

- This also unblocks the zotero desktop-bridge change (225ce01): its new
  COPY infra/images/zotero/* only resolves under repo-root context. Added a
  .dockerignore carve-out (!infra/images/zotero/**) so the scripts ride along.

Verified: pkg_inventory --check + pkg_drift now pass; a probe build confirms
all COPY sources resolve under repo-root context + the real .dockerignore.

.dockerignore

@@ -24,6 +24,10 @@ infra/
 !infra/gitea/
 !infra/gitea/**
 !infra/images/
+# zotero desktop-bridge watchdog + healthcheck, COPYed by zotero.Dockerfile
+# (repo-root context). Dir entry + contents, same pattern as marimo above.
+!infra/images/zotero/
+!infra/images/zotero/**
 assets/
 cloud/
 mirrors/

.gitea/workflows/deploy.yml

@@ -37,7 +37,7 @@ jobs:
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Build notebooks
-        run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build notebooks/
+        run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
 
       - name: Push notebooks
         run: |
@@ -60,8 +60,8 @@ jobs:
   zotero:
     runs-on: ubuntu-latest
     if: >-
-      contains(github.event.head_commit.modified, 'data/zotero') ||
-      contains(github.event.head_commit.modified, 'infra/images/zotero.Dockerfile')
+      contains(github.event.head_commit.modified, 'infra/images/zotero.Dockerfile') ||
+      contains(github.event.head_commit.modified, 'infra/images/zotero')
     steps:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
@@ -85,7 +85,7 @@ jobs:
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Build zotero
-        run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build data/zotero/
+        run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build .
 
       - name: Push zotero
         run: |

.gitea/workflows/harden.yml

@@ -32,7 +32,7 @@ jobs:
           UV_INSTALL_DIR: /usr/local/bin
 
       - name: Build notebooks
-        run: docker build --no-cache -f infra/images/notebooks.Dockerfile -t local/notebooks:build notebooks/
+        run: docker build --no-cache -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
 
       - name: Push notebooks
         run: |
@@ -41,7 +41,7 @@ jobs:
           crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:latest --insecure
 
       - name: Build zotero
-        run: docker build --no-cache -f infra/images/zotero.Dockerfile -t local/zotero:build data/zotero/
+        run: docker build --no-cache -f infra/images/zotero.Dockerfile -t local/zotero:build .
 
       - name: Push zotero
         run: |

.gitea/workflows/infra-ci.yml

@@ -9,8 +9,8 @@ on:
       - 'notebooks/**'
       - 'infra/marimo/**'
       - 'infra/images/notebooks.Dockerfile'
-      - 'data/zotero/**'
       - 'infra/images/zotero.Dockerfile'
+      - 'infra/images/zotero/**'
       - 'docs/**'
       - 'infra/images/docs.Dockerfile'
       - 'infra/images/api.Dockerfile'
@@ -23,8 +23,8 @@ on:
       - 'notebooks/**'
       - 'infra/marimo/**'
       - 'infra/images/notebooks.Dockerfile'
-      - 'data/zotero/**'
       - 'infra/images/zotero.Dockerfile'
+      - 'infra/images/zotero/**'
       - 'docs/**'
       - 'infra/images/docs.Dockerfile'
       - 'infra/images/api.Dockerfile'
@@ -48,7 +48,7 @@ jobs:
 
 
       - name: Build notebooks
-        run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build notebooks/
+        run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
 
       - name: File failure issue
         if: failure()
@@ -76,7 +76,7 @@ jobs:
 
 
       - name: Build zotero
-        run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build data/zotero/
+        run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build .
 
       - name: File failure issue
         if: failure()

.gitea/workflows/rebuild-all.yml

@@ -33,7 +33,7 @@ jobs:
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Build notebooks
-        run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build notebooks/
+        run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
 
       - name: Push notebooks
         run: |
@@ -42,7 +42,7 @@ jobs:
           crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:latest --insecure
 
       - name: Build zotero
-        run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build data/zotero/
+        run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build .
 
       - name: Push zotero
         run: |

data/pkg-manifest.json

@@ -336,6 +336,16 @@
         "version": ">=2.0.0",
         "extras": ""
       },
+      {
+        "name": "markdown-it-py",
+        "version": ">=4.0",
+        "extras": ""
+      },
+      {
+        "name": "mdit-py-plugins",
+        "version": ">=0.4",
+        "extras": ""
+      },
       {
         "name": "pydantic",
         "version": ">=2.0.0",

stack.toml

@@ -224,15 +224,20 @@ hadolint = true
 trivy_severity = "HIGH,CRITICAL"
 trivy_exit_code = 0
 
+# Repo-root context: the Dockerfile COPYs infra/marimo/theme, which only
+# exists at repo root (see .dockerignore carve-outs). Building from notebooks/
+# fails with `"/infra/marimo/theme": not found`.
 [images.notebooks]
 dockerfile = "infra/images/notebooks.Dockerfile"
-context = "notebooks/"
+context = "."
 path_filter = ["notebooks/**", "infra/marimo/**", "infra/images/notebooks.Dockerfile"]
 
+# Repo-root context: the Dockerfile COPYs the desktop-bridge watchdog +
+# healthcheck from infra/images/zotero/ (carved out in .dockerignore).
 [images.zotero]
 dockerfile = "infra/images/zotero.Dockerfile"
-context = "data/zotero/"
-path_filter = ["data/zotero/**", "infra/images/zotero.Dockerfile"]
+context = "."
+path_filter = ["infra/images/zotero.Dockerfile", "infra/images/zotero/**"]
 
 [images.docs]
 dockerfile = "infra/images/docs.Dockerfile"