ci: verify all devcontainer features

[devsy-app]

Spec requirement

The devcontainer spec requires that a devcontainer's declared features are actually
installed and usable in the resulting container. .devcontainer/devcontainer.json
declares four features whose purpose is to install specific binaries:

Feature	Installs
ghcr.io/skevetter/features/go-task:1	task
ghcr.io/skevetter/features/prek:1	prek
ghcr.io/skevetter/features/uv:1	uv
ghcr.io/devcontainers/features/node:2 (v24)	node

The devcontainer CI workflow (.github/workflows/devcontainer.yml) builds the
devcontainer and runs a runCmd smoke-check to verify the image is usable.

Gap found

The runCmd default only verified a single binary:

test -x "$(command -v prek)"

So a devcontainer where task, uv, or node failed to install would still pass the
CI smoke-check, masking a spec-compliance gap: features are declared but their
installed binaries are not verified.

Change

Expand the runCmd default (and the DEFAULT_RUN_CMD env that backs it for
non-dispatch runs) to verify all four feature-provided binaries are on PATH:

for c in task prek uv node; do command -v "$c" >/dev/null 2>&1 || { echo "missing $c" >&2; exit 1; }; done

If any feature binary is missing, the check exits non-zero and prints missing <bin>,
so a broken feature install surfaces in CI instead of passing silently. The set of
checked binaries is exactly the set installed by the declared features.

Verification

• task cli:format — passed (exit 0).
• task cli:lint:ci — passed, 0 new issues.
• task cli:test — passed except the known pre-existing pkg/git failures
  (TestRepoCloneArgsThroughRunner, TestRepoCloneFromInfoBranch,
  TestRepoCloneFromInfoHelper) which fail on origin/main already and are unrelated
  to this change (this PR touches only .github/workflows/devcontainer.yml).
• .github/workflows/devcontainer.yml re-read end-to-end; YAML parses; the runCmd
  value is a single shell invocation consumed by devcontainers/ci (the workflow
  resolves the dispatcher runCmd input with a fallback to the DEFAULT_RUN_CMD
  env var), so the for … done loop executes correctly inside the built devcontainer.
• Devcontainer feature lock integrity verified: the pinned SHA digests in
  .devcontainer/devcontainer-lock.json match the published feature image digests on
  ghcr.io (no stale integrity).
• task cli:test:e2e:suite -- "devcontainer" — not run in this sandbox (requires
  Docker, unavailable here); the workflow itself is the devcontainer build/run gate.

This PR was created by an AI agent as part of an automated daily devcontainer spec job.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	fd577dc
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a79c52c449598000806d337

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	fd577dc
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a79c52c44313c0007d25a99

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}