chore(repo): remove the dead self-host Docker path, fix CI path filters and repo scripts - #2446

🟢 Confidence 9/10 · safe to merge. CI-config and infra deletions only, no runtime path changed; the enlarged shellcheck globs could not be run in the sandbox.
_{no findings · tests partial −1 · risk medium}

Removes the non-functional self-host Docker Compose path, turns the CI ts filter into a positive extglob covering the paths its jobs read, widens the cli and shell filters, and trims the iOS OpenAPI allowlist. No runtime code changes; safe to merge.

• Self-host api/web/ingest/alerting/scraper/otel-collector compose services and both Dockerfiles deleted
• ts filter is now a positive apps/!(ingest|ios)/** extglob with the read-but-unlisted paths added
• cli filter lists packages/** and lib/**; shellcheck runs the shell filter's globs
• iOS OpenAPI allowlist drops getSpan/getLog in the spec and the domain test

Before merge

• Infra · Check every environment has what this config now expects · docker-compose.yml
• Manual · Confirm no self-hoster still runs docker compose up at the repo root: the API, web, ingest and scraper services are gone.

Production impact

_{30b73be · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}