fix(docker): make container emsdk authoritative for exec, stop host emsdk leak

The wxWidgets autoconf build inside Docker failed with `emmake: command not
found` on a clean build, while the KiCad CMake build survived (CMake caches the
absolute compiler path). Two compounding causes:

1. `docker compose exec` bypasses the ENTRYPOINT, so it never sourced
   emsdk_env.sh and EMSDK was unset. env.sh then fell back to the local
   tools/emsdk.

2. The entrypoint's rsync from the host bind mount excluded only build-wasm and
   output, so the host's macOS-arm64 tools/emsdk got copied over the container's
   Linux emsdk. The macOS Mach-O python can't exec on Linux, so
   `emsdk construct_env` failed ("Exec format error") and emcc/emmake never
   landed on PATH.

Fixes:
- Set `ENV EMSDK=/emsdk` in the image so every process (including
  `docker compose exec`) resolves env.sh's EMSDK branch to the container's own
  emsdk and never falls back to tools/emsdk.
- Exclude `tools/emsdk` from the entrypoint rsync so the host emsdk can no
  longer leak into the container.

Validated with a clean wxWidgets build (`build-wxuniversal-wasm.sh --clean`):
reconfigures and compiles all 42 wx libs against /emsdk with no missing-tool
errors.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker/entrypoint.sh

@@ -13,6 +13,7 @@ if [[ -d /workspace-host ]]; then
     rsync -ai --delete \
         --exclude='build-wasm' \
         --exclude='output' \
+        --exclude='tools/emsdk' \
         /workspace-host/ /workspace/ | \
         grep "^>f" | \
         sed "s/^[^ ]* //" | \