Fix Codespaces SSH access with a locked feature

[BrettKinny]

Summary

• add the official Dev Containers SSHD Feature only to the derived Dev Container/Codespaces image
• pin Feature 1.1.0 to reviewed OCI digest sha256:f5251b8e4325f68f7280973c6cd65daff414449c66f240621502d4e8e74eb7ee
• restrict remote-forwarded listeners to loopback and document the upstream SSH security behavior
• add repository, Candidate E2E, CI JSON, release-note, and UAT coverage

Diagnosis

Real v1.2.1-rc1 Codespaces qualification reached Available, but gh codespace ssh and logs failed because the custom Squarebox image had no SSH server. The exact rc1 digest reproduced the missing sshd binary. GitHub recommends the official SSHD Feature for custom Debian-based Codespaces images.

Validation

• regression assertions failed before the fix and now pass
• all 17 executable repository test modules pass
• Dev Containers CLI 0.87.0 build --frozen-lockfile passes
• real derived-container up --frozen-lockfile passes
• /usr/sbin/sshd -t passes, daemon PID is live, and GatewayPorts no is effective
• disposable local container and Managed-home volume removed

v1.2.1-rc1 remains immutable failed Codespaces qualification evidence. After merge, this requires rc2 and a fresh real Codespaces rerun before any final stable tag.