review: harden the Docker image + align GHCR action versions

Address PR #1648 review:

- Bump the GHCR action majors to match current v1 (docker/login-action v4,
  docker/metadata-action v6, docker/setup-buildx-action v4,
  actions/attest-build-provenance v4) to avoid Dependabot churn.
- Make the image tags explicit (`type=semver` + `flavor: latest=true`) instead
  of relying on `flavor.latest=auto`, so a release lands both the version tags
  and `:latest` — the README's bare `ghcr.io/…/inspector` URL won't 404.
- Run the container as the non-root `node` user with /home/node as workdir (its
  writable home is where the inspector stores the catalog / OAuth state).
- Add a HEALTHCHECK that probes `/` via Node's global fetch (no curl in slim).
- Trim specification/ and docs/ from the build context. (test-servers/ stays —
  `tsc -b` typechecks the integration tests that import its alias, so excluding
  it breaks the build.)

Re-verified locally: `docker build` succeeds, the container runs as uid 1000
(node), serves `/` (200), and the HEALTHCHECK reports healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw

.dockerignore

@@ -18,6 +18,12 @@ test-servers/build
 storybook-static
 coverage
 
+# Docs/specs aren't referenced by the build — trim them from the context.
+# (test-servers/ stays: `tsc -b` typechecks the integration tests that import
+# the `@modelcontextprotocol/inspector-test-server` alias.)
+specification
+docs
+
 # Packed tarballs (the image makes its own)
 *.tgz