dockerignore: re-include harness/**/*.tmpl so the integration-harness image builds

[bdchatham]

Summary

Every main ECR run's "Build and push integration-harness image" step has failed since #558 with pattern seiload_job.yaml.tmpl: no matching files found (the controller and sidecar images publish fine, so runs show red but the controller image the platform bump needs is pushed).

#558 moved the //go:embed-ed fault and seiload templates out of test/integration/ into the importable harness/faults and harness/bench packages, but .dockerignore ignores everything by default and only re-included test/integration/**/*.tmpl. The integration suite imports both harness packages, so the go test -c -tags integration build in test/integration/Dockerfile couldn't find the embeds.

• .dockerignore: add !harness/**/*.tmpl; drop the now-dead !test/integration/**/*.tmpl (no .tmpl remains there). Inert in the controller/sidecar build contexts (neither compiles harness/).
• ci.yml docker job: add a third no-push build of test/integration/Dockerfile, so a build-context gap for the harness image fails the PR instead of the first main publish run (the job's existing rationale, which previously only covered the other two images).

Verified locally: docker build -f test/integration/Dockerfile . succeeds on this branch.

Link to Devin session: https://app.devin.ai/sessions/810d9802ec224aeba508275645d3aee2
Open in Devin Desktop: https://app.devin.ai/desktop/session/810d9802ec224aeba508275645d3aee2?variant=devin
Requested by: @bdchatham

[cursor]

PR Summary

Low Risk
Build-context and CI-only changes; no runtime application logic.

Overview
Fixes broken integration-harness image builds after fault/seiload templates moved from test/integration/ into importable harness/ packages.

.dockerignore drops the obsolete !test/integration/**/*.tmpl rule and adds !harness/**/*.tmpl so //go:embed manifests under harness/faults and harness/bench are present when test/integration/Dockerfile runs go test -c -tags integration.

CI adds a non-push Build integration-harness image step alongside controller and sidecar, so future .dockerignore gaps for embed paths only that image needs are caught on PRs instead of on main ECR publish.

^{Reviewed by Cursor Bugbot for commit 67865be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[seidroid]

review found nothing blocking.

[seidroid]

Adds !harness/**/*.tmpl to .dockerignore so the //go:embed-ed fault and seiload manifests that #558 moved into harness/faults and harness/bench reach the integration-harness build context. The pattern matches both embed sites and covers every non-Go embed target in the repo, so the fix is complete for the reported failure; the only note is that CI still cannot catch the next instance. Codex read the diff and reported nothing, which I confirmed for line-level defects — my findings are the CI gap and a stale neighbouring line, neither visible from the diff alone.

Non-blocking

• The CI docker job (.github/workflows/ci.yml) builds only the controller and sidecar images; test/integration/Dockerfile is built solely by the publish workflow on main. That job's own comment says it exists because "the publish workflow only runs on main — so a build-context problem reaches main unseen", citing this exact no matching files found class, yet the one image that failed is not in it. Without adding a third no-push build step there, the next embed added outside the re-include list breaks main the same way.

1 nit, not posted on the code

• .dockerignore:48 — test/integration/ now contains no .tmpl files — harness: importable Chaos-Mesh fault catalog and seiload Job renderer (PLT-1248) #558 moved them all to harness/, so this re-include is dead and the comment above it ("its fault/seiload manifests are //go:embed-ed *.tmpl") no longer describes the tree. Worth dropping the line and trimming the comment while you are here, so the next reader does not assume that path is still covered.

_{seidroid review · decision approve · session 3ce6091bcd9840fe8104ef9fe6611971 · turn resp_claude_14ed79b1e2fb9ad711d4d2cac91c19af · item 8bfd05efa9485b2a9c70721fd783fcc4}

Findings: 0 blocking | 1 non-blocking | 0 posted inline