🐋♻️：replace the dev container with a stock image and features

[DerekNonGeneric]

🐋♻️ Replaces the dev container with a stock image plus features, and fixes
two things found while working out what the old one was actually doing.

The old base image, openinf/grimesai-salvage-tex:lunar, was last
published in February 2024, so the daily development environment has
been sitting on a two-year-old base with no security patches since. Only
two repositories in the org reference it; after this, one
(OpenINF/.github has the identical Dockerfile if you want the same
treatment there).

What was dropped, and why it was safe

Each of these was checked before removing, not assumed:

• Ruby. package-scripts.yml maps verify.ruby and format.ruby to
  verify-ruby.mts and format-ruby.mts; neither file exists. No
  Gemfile, no .ruby-version, no Rakefile. The rubocop extension and the
  [ruby] block in .vscode/settings.json were already commented out. So
  ruby-dev, rbenv and the rbenv PATH entry were dead.
• Ports 4000 and 35729 — Jekyll's server and LiveReload. This site is
  Eleventy behind browser-sync, which serves on 3000 with its UI on 3001,
  so those forwarded nothing.
• The dprint install script, which ran on every container start and
  fetched an unpinned second copy of a tool already pinned at 0.55.2 in
  devDependencies. CI has always used the pinned one — both workflows
  append node_modules/.bin to GITHUB_PATH.
• build-essential, now that every install script is denied and nothing
  compiles from source.
• The sshd on port 2222. VS Code forwards the host's ssh-agent and
  gpg-agent natively, which is what commit signing actually relies on.

Kept: default-jre, without which verify.svg and
verify.htmlValidForVNU die on command not found: java; git-lfs,
which .gitattributes routes 19 file patterns through; the extension
list; and fish.

Node versions

Two managers, doing different jobs:

• nvm.fish is the interactive one. A bare nvm use reads .nvmrc and
  switches that fish session only.
• The image's nvm sets the container-wide baseline. The image puts
  nvm/current/bin on the container's PATH and sets
  NVM_SYMLINK_CURRENT, so nvm use there repoints a symlink every
  non-fish process follows.

Neither can do the other's job: nvm.fish prepends to fish's own PATH and
keeps versions under XDG_DATA_HOME, so nothing outside fish sees it.

No Node version appears in devcontainer.json. It lives in
package.json and .nvmrc, each read by a different tool, and
post-create.sh fails with an explanation if the two disagree rather than
introducing a third copy.

The two accompanying fixes

• .nvmrc now names the exact version rather than a floating alias, which
  would stop matching the exact engines.node pin the next time that
  release line moves.
• publicHoistPattern puts @dprint/* where the dprint VS Code extension
  looks for it. The extension resolves
  node_modules/@dprint/<platform>-<arch>-<family>, which is an
  optionalDependency of dprint and therefore lives in pnpm's virtual
  store — so the directory never existed, and the fallback to a bare
  dprint on PATH failed too because that was only ever on fish's PATH.
  That is why a separately installed dprint was needed. This puts a real
  native binary at the extension's preferred path, at the pinned version.
  It has to go in pnpm-workspace.yaml: pnpm 11 moved these settings and
  public-hoist-pattern in .npmrc is silently ignored.

node_modules/.bin now reaches the whole container through remoteEnv
rather than fish_add_path (pnpm bin) in config.fish, which left every
non-fish caller — CI, editor tasks, agents — without those binaries.

Verification

A container rebuild was not possible in the environment this was written
in, so everything downstream of it was exercised directly instead: the
fisher and nvm.fish installs, nvm use resolving .nvmrc, the universal
nvm_default_version that new interactive fish sessions read, agreement
between fish, bash and sh on the required version, ad-hoc switching in
fish leaving the baseline alone, the dprint binary resolving at the
extension's path and reporting the pinned version, and the full verify
suite.

That leaves one thing unproven: whether the four features install cleanly
onto a fresh image. It fails loudly and immediately on first rebuild if
not. Both SDKMAN Java 21 distributions were confirmed to have
linuxarm64 builds, since the arm64 case was the one most likely to
surprise.

[netlify]

✅ Deploy Preview for gh-pages-openinf ready!

Name	Link
🔨 Latest commit	aca0ca7
🔍 Latest deploy log	https://app.netlify.com/projects/gh-pages-openinf/deploys/6a76c6303ac16c0008940dfa
😎 Deploy Preview	https://deploy-preview-1775--gh-pages-openinf.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.