fix(cli): restrict member manifest copies to the dependency closure

Copying a manifest for every discovered member reached for paths that
.dockerignore may have removed from the build context, so a workspace with an
ignored member outside the closure failed with 'failed to compute cache key'.

uv only needs the target's manifest and those of its workspace dependencies to
resolve --package, so the closure is sufficient. It is also the set whose
sources are already copied and already validated against the ignore spec.

libs/cli/langgraph_cli/uv_lock.py

@@ -970,6 +970,23 @@ def python_config_to_docker_uv_lock(
             f"{uv_export_project_dir}/uv.lock",
         )
     )
+    # `uv export --package` resolves a member by reading that member's own
+    # manifest, so the root manifest names it but is not enough to find it. Only
+    # the manifests are copied; member sources arrive later, per member.
+    #
+    # Restricted to the closure rather than every member. Members outside it are
+    # not needed for the export, and copying them would reach for paths that
+    # `.dockerignore` may have removed from the build context.
+    for member_root in sorted(set(plan.container_roots) - {plan.project_root}):
+        member_relative = pathlib.PurePosixPath(
+            member_root.relative_to(plan.project_root).as_posix()
+        )
+        docker_plan.add_raw(
+            copy_from_project_root(
+                member_relative / "pyproject.toml",
+                f"{uv_export_project_dir}/{member_relative}/pyproject.toml",
+            )
+        )
     docker_plan.add_instruction("WORKDIR", uv_export_project_dir)
     docker_plan.add_instruction(
         "RUN",