chore: add Copilot cloud-sandbox setup + dev container (hve-core-all)

[JoshLuedeman]

Summary

Adds a GitHub Copilot cloud sandbox setup and a matching dev container, both pre-installing the hve-core-all Copilot CLI plugin. Three new files only — no existing code touched.

File	Purpose
.devcontainer/setup-hve-core.sh	Shared, best-effort, idempotent, non-fatal installer for the Copilot CLI + hve-core-all plugin (set -euo pipefail, executable 100755).
.github/workflows/copilot-setup-steps.yml	Single job named exactly copilot-setup-steps that provisions runtimes + repo deps, then runs the installer (continue-on-error).
.devcontainer/devcontainer.json	Ubuntu base + node/python/terraform/github-cli features; postCreateCommand installs deps then the plugin.

Detected stack

• Terraform 1.9 — infra/ (matches TF_VERSION in deploy-infra.yml)
• Python 3.12 — data/generators/, simulator/ (requirements.txt)
• Node.js 22 / TypeScript 5.6 — streaming/ (package-lock.json)
• PySpark notebooks — src/notebooks/

Third-party actions are SHA-pinned with # vX.Y.Z comments, reusing the exact SHAs already vetted in this repo (actions/checkout, actions/setup-python, actions/setup-node, hashicorp/setup-terraform). The workflow checks out with persist-credentials: false, declares permissions: contents: read at both workflow and job level, and both push/pull_request triggers are path-filtered to the workflow file itself.

Build / test / lint commands (from Makefile & CI)

• Install deps: make setup → pip install -r data/generators/requirements.txt + cd streaming && npm install
• Build (streaming): cd streaming && npm run build (tsc)
• Test (streaming): cd streaming && npm test --if-present
• Lint: make lint → cd infra && terraform fmt -check -recursive + cd data/generators && python -m py_compile generate_all.py
• Data generation: make generate-data

The sandbox installs Python deps (data/generators + simulator) and runs npm ci in streaming, both continue-on-error: true.

✅ hve-core-all install result — SUCCESS (verified on a clean GitHub-hosted Ubuntu 24.04 runner)

The copilot-setup-steps workflow ran green on this PR. Verbatim log from the "Install hve-core-all plugin" step (bash .devcontainer/setup-hve-core.sh) on a clean runner where the Copilot CLI was not preinstalled:

🔌 Installing GitHub Copilot CLI + hve-core-all plugin (best-effort)...
added 3 packages in 4s
Marketplace "hve-core" added successfully.
Plugin "hve-core-all" installed successfully.
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)
🔌 hve-core-all setup finished.

The "Verify tools" step confirms the full toolchain + plugin:

Terraform v1.9.8
Python 3.12.13
v22.23.1                       (node)
10.9.8                         (npm)
GitHub Copilot CLI 1.0.73.
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)

No authentication was required — npm install -g @github/copilot, copilot plugin marketplace add microsoft/hve-core, and copilot plugin install hve-core-all@hve-core all succeeded headlessly on the first run. Script exit code 0.

Validation performed

Check	Result
copilot-setup-steps workflow (pull_request + push)	✅ PASS (green) — see logs above
actionlint v1.7.7 on the workflow	✅ PASS (exit 0)
jq empty on devcontainer.json	✅ Valid strict JSON
Node require() parse of devcontainer.json	✅ Parses
bash -n + LF line-endings on setup-hve-core.sh	✅ OK, executable bit 100755
Headless hve-core-all install	✅ SUCCESS on clean Ubuntu runner (v3.3.101)
devcontainer build	⚠️ Not run — Docker unavailable on the local validation host; config validated via jq + Node parse. (The same features/base image are standard devcontainer components.)

Known non-blocking item (pre-existing, out of scope)

The "Install Node.js dependencies" step (npm ci in streaming/) exits 1 due to a pre-existing peer-dependency conflict in streaming/package.json — unrelated to this PR:

npm error code ERESOLVE — unable to resolve dependency tree
npm error While resolving: tales-and-timber-iot-simulator@2.0.0
npm error   dev typescript@"5.6.0" from the root project
npm error peer typescript@">=2.7" from ts-node@10.9.0

This step is intentionally continue-on-error: true, so it does not fail the job, and the hve-core-all install still runs and succeeds immediately afterward — demonstrating the best-effort / non-blocking design. Per the three-files-only scope, the repo's streaming dependency tree was not modified here (fixing it — e.g. bumping ts-node, or using npm ci --legacy-peer-deps — is a separate change).

Notes

• The hve-core-all install is best-effort / non-blocking: every step is guarded so the sandbox and dev container start even if the plugin install fails.
• Auto-merge intentionally not enabled.