chore: add Copilot cloud-sandbox setup + dev container (pre-install hve-core-all)

[JoshLuedeman]

Summary

Adds a GitHub Copilot cloud-sandbox setup and a matching dev container that both pre-install the hve-core-all Copilot CLI plugin from microsoft/hve-core. Three files only; no existing code touched.

✅ Verified live in this PR's CI

The copilot-setup-steps workflow ran on a clean ubuntu-latest runner for this PR and every step passed (conclusion: success), including a real, headless, unauthenticated hve-core-all install:

==> Ensuring GitHub Copilot CLI is installed
==> Adding hve-core plugin marketplace (microsoft/hve-core)
Marketplace "hve-core" added successfully.
==> Installing hve-core-all plugin
Plugin "hve-core-all" installed successfully.
==> Installed Copilot plugins:
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)
copilot: GitHub Copilot CLI 1.0.73.

Step results: Checkout ✅ · Setup Node.js ✅ · Install dependencies (npm ci) ✅ · Install hve-core-all plugin ✅ · Verify tools ✅.

Files added

• .devcontainer/setup-hve-core.sh — shared, best-effort, non-fatal, idempotent installer (set -euo pipefail, executable 100755). Installs the Copilot CLI if missing, adds the microsoft/hve-core marketplace, installs hve-core-all@hve-core, and prints copilot plugin list. Every step degrades to a ::warning:: so the sandbox / dev container still starts on failure (e.g. no network or interactive auth required).
• .github/workflows/copilot-setup-steps.yml — workflow_dispatch + push/pull_request filtered to this workflow file; top-level permissions: contents: read; one job named exactly copilot-setup-steps on ubuntu-latest (job-level contents: read). Steps: checkout (persist-credentials: false) → setup Node 20 + npm cache → npm ci (continue-on-error) → Install hve-core-all plugin running bash .devcontainer/setup-hve-core.sh (continue-on-error, GITHUB_TOKEN: ${{ github.token }}) → Verify tools.
• .devcontainer/devcontainer.json — mcr.microsoft.com/devcontainers/typescript-node:20 base + ghcr.io/devcontainers/features/node:1 (v20); postCreateCommand: npm ci && bash .devcontainer/setup-hve-core.sh.

Detected stack

• Language: TypeScript (strict, ESM) · Runtime: Node.js (engines >=18; CI matrix 18/20/22; release uses Node 20) · Package manager: npm (package-lock.json, npm ci).
• Node 20 chosen for the setup workflow and dev container to match the repo's release Node version.

Exact build / test / lint commands (from package.json)

• Build: npm run build (tsup)
• Typecheck: npm run typecheck (tsc --noEmit)
• Lint: npm run lint (eslint src)
• Test: npm test (vitest run)

Action pinning

The repo's existing workflows pin by floating @v4 tags (not SHA). Because this is a security-sensitive setup file, third-party actions here are pinned by full commit SHA with a version comment:

• actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
• actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

Validation

Check	Result
Live copilot-setup-steps run on this PR (ubuntu-latest)	✅ success — all steps green
npm ci on the runner	✅ success (Install dependencies step)
Real hve-core-all install on the runner	✅ Marketplace "hve-core" added successfully → Plugin "hve-core-all" installed successfully → hve-core-all@hve-core (v3.3.101)
actionlint on the workflow	✅ exit 0, no issues (includes shellcheck of run: blocks)
devcontainer.json strict-JSON parse (jq empty)	✅ valid
devcontainer build	⚠️ not run locally — no Docker on the Windows validation host; the same postCreate commands (npm ci + the installer) are proven green by the CI run above

Local validation note: the machine used to author these files was Windows (no Docker, WSL virtualization disabled) with a global .npmrc forcing an internal npm proxy, so npm ci and a local devcontainer build couldn't run there. Both are now confirmed working by the live CI run on the actual Linux runner, and both are non-blocking in the delivered config regardless.

hve-core-all install result — ✅ SUCCESS

• On the real CI runner (authoritative): marketplace added and hve-core-all@hve-core (v3.3.101) installed with no authentication required; the Install hve-core-all plugin step concluded success (see log excerpt above).
• Locally (Copilot CLI v1.0.74): copilot plugin install hve-core-all@hve-core → Plugin "hve-core-all" installed successfully. and copilot plugin list shows hve-core-all@hve-core (v3.3.101).

Headless verdict: hve-core-all installs successfully and appears in copilot plugin list (v3.3.101).

Notes

• Best-effort / non-blocking: the plugin install never fails the sandbox or the dev container (every step falls back to a ::warning::; the workflow step is continue-on-error).
• Auto-merge is not enabled.