fix deno cache copy in Docker build

[IsaacThoman]

What changed

• Replaced the Docker build-stage cp -a /tmp/deno-cache/. /deno-dir with a tar pipeline.
• Excluded Deno SQLite cache sidecar files matching *-wal and *-shm from the copied runtime cache.

Why

Recent Coolify deployments failed nondeterministically when cp -a tried to copy transient Deno cache SQLite sidecar files after they disappeared:

cp: cannot stat '/tmp/deno-cache/./dep_analysis_cache_v2-wal': No such file or directory
cp: cannot stat '/tmp/deno-cache/./dep_analysis_cache_v2-shm': No such file or directory

Those files are not required in the runtime image, so excluding them prevents the deployment from failing on a cache race.

Validation

• deno task allchecks
• GitHub CI push checks will validate Docker build and container healthcheck.

Local Docker smoke testing could not run because the local Docker socket was unavailable.