fix(devcontainer): publish only multi-arch tags, push per-arch by digest

[Copilot]

The dotfiles-devcontainer package exposed rolling :amd64 / :arm64 tags that drifted out of sync with the platform digests inside :latest (the :amd64 tag pointed at a newer digest than :latest's amd64 entry). Each native-runner build pushed its own per-arch tag independently, and the merge job composed :latest by resolving those mutable tags.

Workflow (.github/workflows/devcontainer-prebuild.yaml)

• Build each arch with the Dev Container CLI and push by digest only — no :amd64 / :arm64 tags; per-arch images are stored untagged.
• Export each pushed digest as an artifact; the merge job composes :latest and :vX.Y.Z from the exact digests built in the same run via docker buildx imagetools create, so the multi-arch tags always reference matching platform images.
• Replaces the devcontainers/ci action with a direct devcontainer build call (the action always tags, which is what created the stray tags).
• Caching preserved without extra tags: registry cache from :latest (same pattern as ci.yaml) plus the CLI's inline cache. PR runs build for validation only.

# per-arch (native runner): untagged, push-by-digest
devcontainer build --platform "$PLATFORM" --image-name "$IMAGE" \
  --cache-from "type=registry,ref=$IMAGE:latest" \
  --output "type=image,name=$IMAGE,push-by-digest=true,name-canonical=true,push=true"

# merge: compose multi-arch tag from this run's digests
docker buildx imagetools create --tag "$IMAGE:latest" \
  "$IMAGE@$AMD64_DIGEST" "$IMAGE@$ARM64_DIGEST"

Tests (tests/bash/validate-devcontainer.bats)

• Updated the release-tag assertion to the imagetools create command.
• Added a test asserting per-arch push-by-digest, manifest composition, and absence of imageTag: ${{ matrix.arch }} rolling tags.

Notes

• Per-arch digests are parsed from buildkit's exporting manifest list output: the Dev Container CLI doesn't forward buildx's --metadata-file, so this is the available capture path.
• Existing :latest@sha256:… pin in devcontainer.json still resolves — :latest remains a multi-arch manifest list.

[DevSecNinja]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged origin/main and resolved the conflict in .github/workflows/devcontainer-prebuild.yaml. The conflict was in the merge job where main added a Checkout repository step (needed by script/devcontainer-image-size.sh) and this branch added a Set up Docker Buildx step (needed by imagetools create); I kept both. validate-devcontainer.bats passes (10/10). Merge commit: c9859ed.