fix(docker): make container emsdk authoritative for exec, stop host emsdk leak

The wxWidgets autoconf build inside Docker failed with `emmake: command not
found` on a clean build, while the KiCad CMake build survived (CMake caches the
absolute compiler path). Two compounding causes:

1. `docker compose exec` bypasses the ENTRYPOINT, so it never sourced
   emsdk_env.sh and EMSDK was unset. env.sh then fell back to the local
   tools/emsdk.

2. The entrypoint's rsync from the host bind mount excluded only build-wasm and
   output, so the host's macOS-arm64 tools/emsdk got copied over the container's
   Linux emsdk. The macOS Mach-O python can't exec on Linux, so
   `emsdk construct_env` failed ("Exec format error") and emcc/emmake never
   landed on PATH.

Fixes:
- Set `ENV EMSDK=/emsdk` in the image so every process (including
  `docker compose exec`) resolves env.sh's EMSDK branch to the container's own
  emsdk and never falls back to tools/emsdk.
- Exclude `tools/emsdk` from the entrypoint rsync so the host emsdk can no
  longer leak into the container.

Validated with a clean wxWidgets build (`build-wxuniversal-wasm.sh --clean`):
reconfigures and compiles all 42 wx libs against /emsdk with no missing-tool
errors.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker/Dockerfile

@@ -32,6 +32,13 @@ RUN git clone https://github.com/emscripten-core/emsdk.git /emsdk \
     && ./emsdk install ${EMSCRIPTEN_VERSION} \
     && ./emsdk activate ${EMSCRIPTEN_VERSION}
 
+# Make Docker's own emsdk authoritative for EVERY process in the container, including
+# `docker compose exec` (which bypasses the ENTRYPOINT). env.sh keys off $EMSDK: with it
+# set, env.sh sources /emsdk/emsdk_env.sh and never falls back to the local tools/emsdk
+# (which, inside this Linux container, can be a host macOS emsdk rsync'd in by mistake and
+# thus unrunnable). This is what lets the wxWidgets autoconf build find emmake on PATH.
+ENV EMSDK=/emsdk
+
 # Configure ccache for Emscripten
 # CCACHE_DIR in named volume persists across containers
 ENV CCACHE_DIR=/workspace/build-wasm/.ccache

docker/entrypoint.sh

@@ -13,6 +13,7 @@ if [[ -d /workspace-host ]]; then
     rsync -ai --delete \
         --exclude='build-wasm' \
         --exclude='output' \
+        --exclude='tools/emsdk' \
         /workspace-host/ /workspace/ | \
         grep "^>f" | \
         sed "s/^[^ ]* //" | \