feat: Phase 1 P1 — Dockerfile, AGNTCY alignment docs, Node.js SDK

Three remaining Phase 1 P1 deliverables:

1. Dockerfile — multi-stage build (builder + production), node:18-alpine,
   non-root USER node, .dockerignore excluding secrets and dev artifacts

2. AGNTCY alignment docs (docs/agntcy/) — README and alignment.md mapping
   all 6 AGNTCY domains to AgentIdP features with Phase 2/3 pending items noted

3. Node.js SDK (@sentryagent/idp-sdk) — TypeScript strict, zero any, native
   fetch (Node 18+), TokenManager with 60s auto-refresh, service clients for
   all 14 endpoints (agents, credentials, tokens, audit), AgentIdPError typed
   error hierarchy, full README

All three changes tracked under openspec/changes/ with tasks marked complete.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openspec/changes/dockerfile/tasks.md

@@ -0,0 +1,14 @@
+## 1. Dockerfile
+
+- [x] 1.1 Write multi-stage Dockerfile: builder stage (node:18-alpine, npm ci, npm run build)
+- [x] 1.2 Write production stage: node:18-alpine, npm ci --omit=dev, copy dist/, USER node
+- [x] 1.3 Set EXPOSE 3000, CMD ["node", "dist/server.js"]
+
+## 2. .dockerignore
+
+- [x] 2.1 Write .dockerignore excluding: node_modules, dist, coverage, tests, .env, *.pem, vj_notes, .cto-workspace, .claude, next_steps.md
+
+## 3. QA
+
+- [x] 3.1 Verify Dockerfile build stages are correct and complete
+- [x] 3.2 Verify .dockerignore covers all sensitive/unnecessary files