fix: harden devcontainer policy validation and add test coverage

[pmembrey]

Summary

• Reserve DISABLE_AUTOUPDATER as a protected container env key. Previously a user-provided [container_env] DISABLE_AUTOUPDATER = "0" silently overrode the Bulkhead-set value. Now rejected at validation time, matching the pattern for CLAUDE_CONFIG_DIR and BULKHEAD_SELECTED_AGENTS.
• Replace --cap-add blocklist with an explicit capability allowlist. The old check blocked SYS_ADMIN (substring match) and ALL (exact match) but allowed other dangerous capabilities like SYS_PTRACE, SYS_MODULE, and SYS_RAWIO. Now only NET_ADMIN and NET_RAW are permitted; all other capabilities are rejected. Both --cap-add=VALUE and --cap-add VALUE (split) forms are validated.
• Deduplicate remote_user_home into config.rs. The "if root then /root else /home/{user}" pattern was duplicated in devcontainer.rs, config.rs::gitconfig_target, and config.rs::PreinstalledAgent::config_target. Consolidated into a single pub(crate) fn remote_user_home.
• Deduplicate render_command by reusing system::render_command. commands/clone.rs had its own 5-line copy. Made the generic version in system.rs pub(crate) and deleted the duplicate.
• Add bash -n syntax check for bulkhead-post-create.sh to scripts/verify.sh. Shell syntax errors in the embedded template were previously silent until container startup.
• Add 32 new tests covering previously untested security-critical validation code:
  • resolve_workspace_config_path: empty input, absolute paths, home expansion, variable expansion, directory traversal, valid paths (8 tests)
  • sanitize_volume_name: valid names, special char replacement, dash trimming, all-special-char inputs (4 tests)
  • is_docker_socket_path: standard locations, non-socket path rejection (2 tests)
  • remote_user validation: empty, whitespace-only, special characters, valid usernames (4 tests)
  • normalize_container_path: relative rejection, root escape, dot/slash normalization, root handling, trailing slash (5 tests)
  • validate_run_args edge cases: --privileged=true, split-form namespace flags, --volumes-from, case-insensitive ALL, safe arg acceptance (5 tests)
  • --cap-add allowlist: dangerous capabilities rejected, allowed capabilities accepted, split form rejection (3 tests)
  • DISABLE_AUTOUPDATER reservation (1 test)

Changes by commit

Commit	Scope	Files
e77ea7d ci: add bash syntax check for post-create script	CI	scripts/verify.sh
19ac283 refactor: deduplicate render_command	Dedup	src/system.rs, src/commands/clone.rs
8562b81 refactor: deduplicate remote_user_home and add config.rs test coverage	Dedup + Tests	src/config.rs
28ca576 fix: harden devcontainer security policy and add test coverage	Security + Tests	src/devcontainer.rs

Test plan

• cargo test passes (34 -> 66 tests, all green)
• cargo clippy --all-targets -- -D warnings clean
• cargo fmt --all -- --check clean
• bash -n templates/bulkhead-post-create.sh passes
• cargo deny check passes
• ./scripts/verify.sh passes at every commit
• Verify audit preset still works: --cap-add=NET_ADMIN and --cap-add=NET_RAW accepted
• Verify agents = ["claude"] with no DISABLE_AUTOUPDATER override works as before
• Verify --cap-add=SYS_PTRACE is now rejected (was previously accepted)