Add a devcontainer baseline-consistency check (detection, not auto-fix)

[gavinbee]

Goal

Ensure every repo's devcontainer is consistent enough — shares a common baseline — while letting each repo add its own extras on top. This is a detection check that reports drift; it does not rewrite repo files, and it is not part of apply-settings.py (that reconciler PATCHes GitHub settings via the API; a devcontainer is file content, a different mechanism — see discussion in #29 / docs/design/0002-venv-standard.md).

What "consistent enough" means

A shared baseline every devcontainer must include, not an identical file:

• Universal (all repos): the Claude Code devcontainer feature
  (ghcr.io/anthropics/devcontainer-features/claude-code).
• Python repos: venv provisioning via postCreateCommand (creates .venv, installs
  requirements-dev.txt) per the standard in
  docs/design/0002-venv-standard.md.

Repos remain free to add image choices, extra features, extensions, extra postCreate steps, etc. The check asserts the floor, not the whole file.

Mechanism (sketch)

• A scheduled job (sibling to the reconciler, not inside apply-settings.py) that reads each repo's .devcontainer/devcontainer.json and verifies the baseline elements are present.
• On a gap, report — open/update a tracking issue on the offending repo (or emit a summary), rather than committing anything.
• The canonical baseline should live in .github as the source of truth (e.g. a documented snippet or a small JSON the checker compares against), so "the baseline" is declarative, like settings.yml is for settings.
• Non-Python repos (e.g. rems-sync-apps-script, JavaScript) are checked only against the universal portion (Claude Code), not the venv portion.

Sequencing / prerequisites

• Depends on the per-repo rollout first: most repos have no devcontainer yet (tracked in the per-repo issues spun off Define org venv standard + provision venv in the .github devcontainer #29). A check is only useful once there's something to check and a settled baseline.
• Likely warrants its own design doc (how the baseline is declared, how the check parses/asserts it, report vs. issue-open behavior) before implementation.

Explicitly out of scope

• Auto-fixing / syncing files into repos (an org file-sync workflow is a separate, heavier option).
• Folding this into the settings reconciler.