chore: add Copilot cloud sandbox + dev container with hve-core-all plugin

[JoshLuedeman]

Summary

Adds a GitHub Copilot cloud-sandbox setup tailored to this repo's TypeScript/Node.js MCP stack, plus a matching dev container. Both pre-install the hve-core-all Copilot CLI plugin from microsoft/hve-core via a shared, best-effort install script.

Three files only; no unrelated code touched.

What was added

• .devcontainer/setup-hve-core.sh — shared, idempotent, non-fatal installer. Installs the @github/copilot CLI if missing, adds the microsoft/hve-core marketplace, installs hve-core-all@hve-core, then lists plugins. Every step is best-effort (|| echo "::warning::...") so the sandbox always starts even if install fails.
• .github/workflows/copilot-setup-steps.yml — the copilot-setup-steps workflow the coding agent runs to prepare its environment: sets up Node 20 + npm cache, runs npm ci, runs the shared script, then prints tool versions.
• .devcontainer/devcontainer.json — dev container on mcr.microsoft.com/devcontainers/typescript-node:20 (Node built in for the plugin install) with a postCreateCommand that runs npm ci then the shared script.

Detected stack

• Language/runtime: TypeScript (ESM), Node.js (engines.node >= 20; CI matrix tests Node 20 & 22)
• Package manager: npm (package-lock.json)
• Kind: Model Context Protocol (MCP) server (@modelcontextprotocol/sdk)
• Test/lint tooling: vitest, eslint (flat config), prettier
• Existing workflows: .github/workflows/ci.yml, .github/workflows/release.yml

Build / test / lint commands (from package.json)

Purpose	Command
Build	npm run build (tsc -p tsconfig.json)
Test	npm test (vitest run)
Lint	npm run lint (eslint .)
Typecheck	npm run typecheck (tsc --noEmit)
Format check	npm run format:check (prettier --check .)
Smoke	npm run smoke
Install deps	npm ci

hve-core-all install result — SUCCESS (headless, confirmed on GitHub-hosted Ubuntu CI)

Confirmed end-to-end by the copilot-setup-steps check on this PR (run 29946590160, ubuntu-24.04, GITHUB_TOKEN with contents: read, no interactive auth). The Copilot CLI installed fresh on the clean runner and the plugin installed from the public microsoft/hve-core marketplace:

==> Ensuring the GitHub Copilot CLI is available
added 3 packages in 4s
==> Registering the microsoft/hve-core plugin marketplace
Marketplace "hve-core" added successfully.
==> Installing the hve-core-all plugin
Plugin "hve-core-all" installed successfully.
==> Installed Copilot plugins:
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)

Verify step reported: node v20.20.2, npm 10.8.2, copilot: GitHub Copilot CLI 1.0.73.

Verdict: the headless hve-core-all install succeeds.

Validation

Check	Result
copilot-setup-steps workflow on this PR (push + pull_request)	pass (real ubuntu-24.04 runner)
actionlint (v1.7.12) on the workflow	pass, no issues
prettier --check on the yml + json	pass
devcontainer.json JSONC parse (jq empty after comment-strip)	pass
bash -n syntax check on the script	pass
npm ci (dependency-install dry-run)	pass
existing repo CI (lint + typecheck + test + build, node 20/22 × ubuntu/windows)	pass — unaffected by these 3 files
devcontainer build	skipped — Docker unavailable in the validation environment; devcontainer.json validated via JSONC parse + schema keys instead

Notes / deviations

• Action pinning: The task required pinning third-party actions by full commit SHA. The repo's existing workflows (ci.yml, release.yml) use major-version tags (@v4); this new agent-facing workflow SHA-pins for supply-chain safety, with the version in a trailing comment (verified downloaded by SHA in the CI logs):
  • actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
  • actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
• Node in the workflow is pinned to 20 (the repo's engines.node floor and first CI matrix entry) and set up unconditionally so the plugin install always has Node available.
• The plugin install is best-effort / non-blocking in both the workflow step (continue-on-error: true) and the dev container, so the environment always comes up.

Auto-merge intentionally NOT enabled.