feat(devcontainer)!: start from the base image; drop the published image

[justinmerrell]

Summary

• The dev container builds directly from mcr.microsoft.com/devcontainers/base:ubuntu-24.04. The lifecycle scripts move to .devcontainer/scripts/.
• mise comes from a local Feature, .devcontainer/features/mise/:
  • It installs the pinned release (min_version) with no api.github.com call. devcontainers-extra/features/mise resolves every version through the API without authentication, so it isn't used.
  • It puts the mise shims on PATH.
  • verify-toolchain.sh fails if the Feature's version and min_version differ.
• Removed (the image was never published, so nothing depends on it):
  • .devcontainer/image/
  • release-please, release.yaml and the release-tags ruleset
  • version.txt, CHANGELOG.md and .repo/outputs.toml
  • hadolint (its pin, config, lint task, lefthook job and CI step)
• Added, from a survey of the org's repositories:
  • corepack, so pnpm and yarn resolve from packageManager
  • an opt-in Rust Feature
  • commented mise pins for OpenTofu, tflint, terraform-docs, doctl, cloudflared and buf
• CONFIGURATION.md and LAYOUT.md move to docs/. Decision 0004 supersedes 0001 and 0003.
• Polish pass: about 15 stale references and inaccurate claims fixed, and one unused helper and one unused parameter removed.
• DEVC-03 is waived for the local Feature. The devcontainer CLI never locks local Features: DEVC-03 reports local Features (./…) the devcontainer CLI never locks engineering-conventions#106.

Test plan

• task check: lint, repo check, 45 tests, conventions check --fail-on warning with no findings
• ShellCheck over .devcontainer/**/*.sh
• devcontainer up --frozen-lockfile plus a full post-create, twice. verify-toolchain.sh passes (mise 2026.8.6, every pin installed), pnpm --version returns 10.33.0 through corepack, and task and uv resolve from the shims the Feature puts on PATH
• Every relative Markdown link and anchor resolves
• CI: Validate / Required

Follow-ups outside this repository

• infra-github: the RELEASE_APP_* variables and secrets, and the release App's tag bypass, are now unused.
• engineering-conventions: issues for moving the general .repo/governance policies and the env tools upstream.

🤖 Generated with Claude Code