Add Dockerfile and document how to run Sentinel in a container

[wxiao0421]

Summary

• Add a Dockerfile (default, GPU-capable) that installs the sentinel library with the sbert extra (sentence-transformers + torch) via Poetry + poetry.lock, and runs the beginner demo (examples/beginner_demo.py) by default.
• Add a Dockerfile.cpu variant that installs the CPU-only torch build (from the PyTorch CPU index) for a much smaller image (~1.5-2.5 GB vs ~6-8 GB) when a GPU isn't needed.
• Add a .dockerignore to keep the build context small (excludes .git, .venv, caches, editor cruft, etc.).
• Add a Run with Docker section to the README covering both image variants (with a comparison table), build, run, model caching, and running custom scripts, written for newcomers.
• Include examples/beginner_demo.py (the default container entrypoint), a ~1-screen end-to-end demo that builds a tiny in-memory index and scores example messages.
• Fix pre-existing broken code fences in the README (an unterminated Python block plus a stray closing fence) that caused headings through "How It Works" to render as code.
• Minor whitespace tidy-up in pyproject.toml (no dependency/config changes).

Details

• Base image python:3.11-slim.
• Default Dockerfile: installs Poetry >=2.0,<3.0 to match the project's poetry-core>=2.0.0 build backend; dependency install is layered separately from app code so Docker can cache the slow dependency step.
• Dockerfile.cpu: installs CPU torch first from https://download.pytorch.org/whl/cpu, then pip install ".[sbert]" so torch stays CPU-only. Note: this variant uses pip (not the lockfile), so it is not fully pinned.
• Both run as a non-root sentinel user; HF_HOME points at that user's cache dir so model downloads can be persisted via a mounted volume.

Test

Default (GPU-capable) image:

• docker build -t sentinel . completes successfully.
• docker run --rm sentinel runs the beginner demo and prints per-message scores.
• docker run --rm -v "$(pwd)/.hf-cache:/home/sentinel/.cache/huggingface" sentinel reuses the cached model on a second run.
• docker run --rm -it sentinel bash drops into an interactive shell.

CPU-only image (Dockerfile.cpu):

• docker build -f Dockerfile.cpu -t sentinel:cpu . completes successfully.
• docker run --rm sentinel:cpu runs the beginner demo and prints per-message scores.
• Confirm the CPU image is substantially smaller than the default (e.g. docker images sentinel).
• docker run --rm sentinel:cpu python -c "import torch; print(torch.__version__)" shows a +cpu build with no CUDA/nvidia packages.

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[vcai4071]

LGTM!