Emit excluded parent dirs of files re-included by dockerignore negations

[Rogerjaytw]

Motivation

Fixes apple/container#1800.

A .dockerignore that excludes a directory's contents but re-includes some of its descendants with negation patterns (the default Rails template does this):

/foo/*
!/foo/.gitkeep
/foo/bar/*
!/foo/bar/.gitkeep

fails the build during [internal] load build context with:

Error: unknown: "failed to solve: changes out of order: "foo/bar/.gitkeep" "foo/.gitkeep""

The walk filter in pkg/fssync/walk.go dropped excluded entries unconditionally. The directory foo/bar itself is excluded by /foo/* and never emitted, while foo/bar/.gitkeep is re-included by !/foo/bar/.gitkeep and streamed to BuildKit as an orphan. BuildKit's receiver (fsutil's Validator) requires every file to arrive after its parent directory and rejects the stream with exactly the error above.

Change

Replace the hand-rolled patternmatcher filtering in Walk with fsutil.NewFilterFS wrapped around the context FS in DiffCopy, mirroring how BuildKit's own filesync provider filters a local context. fsutil implements the full pattern semantics — in particular it lazily emits excluded ancestor directories before a re-included descendant — so .dockerignore handling now matches Docker exactly.

This also passes the exclude patterns from the request metadata through as-is instead of joining and re-splitting them on commas, which previously broke patterns containing a comma.

Scope note: include-pattern filtering stays delegated to the host side (followpaths) as before; only exclude-pattern handling moves into the fsutil filter.

Testing

• Added a regression test that replays the issue's context tree and patterns through filteredFS + the sender walk, asserting both the emitted order (foo, foo/.gitkeep, foo/bar, foo/bar/.gitkeep) and acceptance by fsutil's Validator — the same check BuildKit's receiver runs. On the previous code the validator rejects the stream with the exact error from the issue.
• go test ./... passes; gofmt clean; go mod tidy && go mod vendor in sync.

🤖 Developed in collaboration with Claude Code