Build compiled assets into APP_DIR/assets, out of the repo tree

[JonJagger]

The precompiled app.css/app.js are build artifacts, but they lived under
source/public/assets inside the source tree, kept out of git only by
.gitignore entries and regenerated locally by bin/build_assets.sh. Treat
them as pure build output instead: compile them solely in the Dockerfile
and serve them from a ${APP_DIR}/assets sibling of source/, so nothing
precompiled ever sits in the repo or the working tree.

• Dockerfile copies the compiled assets to ${APP_DIR}/assets, and app.rb locates them via ENV.fetch('APP_DIR') instead of a public/ subdir.
• Drop the .gitignore entries and the local source/public/assets/app.{css,js}; the assets now exist only inside the built image.
• error.erb switches from the bare /assets/app.{css,js} paths to the hashed CSS_PATH/JS_PATH already used by the main layout, so it gets the same one-year immutable caching. The bare-path routes and their EB5003/EB5004 tests are then removed as dead.
• Remove the now-unused local asset build plumbing: bin/build_assets.sh, the make assets target, the docker-compose asset_builder service, and its env vars in echo_env_vars.sh. The Dockerfile's own asset_builder build stage compiles the assets, so this compose service had no remaining consumer.
• COPY lines chown to nobody:nogroup so file ownership is guaranteed by the image rather than inherited by chance from the build stage.
• Correct the Makefile .PHONY line, which named targets that do not exist (probe, snyk-container, snyk-code) and omitted the real ones.