X_IMAGE_SECRET_UNIGNORED
Means
a *.dockerignore in this tree excludes .env and .npmrc but not .secrets.key, or a Dockerfile has no ignore file at all — no <Dockerfile>.dockerignore, no .dockerignore at or above it
Typical cause
the build stage's COPY . . then bakes the AES master key into a layer beside the committed secrets.enc.json it decrypts, and findMasterKey reads the key FILE whenever ULTIMATE_SECRETS_KEY is unset — so the container boots on the baked key and the platform's key is never exercised, while wiki/CLI-Reference.md promises an image that "ships no key file at all". All four ignore files carried the .env block and none carried this line
Fix
bun run scripts/image-contract.ts --json — the fix names the file; add **/.secrets.key beside its .npmrc line