feat: devcontainer Go + sandbox csdd; hooks/pre-push opt-in (+ Java)

[protonspy]

Summary

Two related developer-experience changes, split into one commit each.

1. Go in the devcontainer + csdd in scaffolded sandboxes

• .devcontainer/ now provisions Go: the go:1 devcontainer feature pinned to the CI toolchain (1.25) + golangci-lint 2.12.2, the Go module proxy / checksum / vuln domains added to the default-deny egress allow-list, gofmt/organize-imports on save, and a postCreateCommand that warms the module cache (+ govulncheck) while egress is still open.
• csdd sandbox init template now preinstalls @protonspy/csdd via npm alongside Claude Code, so csdd is on PATH in every scaffolded sandbox (Go itself is still added on demand with --feature go).

2. Hooks & pre-push are now opt-in; pre-push gained Java

• csdd init no longer scaffolds .claude/hooks/ or .githooks/pre-push by default. Opt in with --include hooks,pre-push (alias prepush) or the --hooks / --prepush convenience flags.
• settings.json ships permissions-only by default; the hook wiring moved to settings-hooks.json.tmpl and is merged in only when hooks are opted into — a default workspace never references hook scripts it didn't scaffold.
• csdd update only refreshes hooks when the workspace already has them, so it never re-adds hooks a project deliberately omitted.
• The pre-push test gate now detects Maven (pom.xml) and Gradle (build.gradle/.kts), preferring the checked-in wrapper.

Test plan

• go build ./..., go vet ./..., gofmt -l . clean.
• Full suite green (go test ./...), including new tests: default omits both opt-in components (+ settings.json has no hook wiring); --include hooks,prepush and --hooks scaffold + wire correctly; --exclude hooks|pre-push is now rejected.
• Manual scaffold verified: default csdd init → no hooks/pre-push, permissions-only settings; --hooks --prepush → 3 executable hook scripts + executable pre-push, settings.json = {hooks, permissions}.
• csdd sandbox init --feature go renders valid JSONC with the npm csdd install and the Go firewall domains.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WvEqtUfoV8q1E5UbwCugqm