fix(claude-code): fix template lifecycle wiring and persist gh config

[gatezh]

What

Fixes three problems in the claude-code template's lifecycle config:

• a dangling waitFor
• bun install failing without a package.json
• the gh login being lost on every rebuild

Why

• claude-code template: waitFor points at an undefined postCreateCommand, and updateContentCommand's unguarded bun install breaks package.json-less consumers #107, Finding 1: the default variant had "waitFor": "postCreateCommand" but no postCreateCommand. The README, the init-plugins.sh header and a Dockerfile comment all said to put init-plugins.sh there.
• claude-code template: waitFor points at an undefined postCreateCommand, and updateContentCommand's unguarded bun install breaks package.json-less consumers #107, Finding 2: bun install exits 1 without a package.json, which aborts the remaining lifecycle commands for static or not-yet-scaffolded projects.
• gh config volume #114: gh keeps its credentials in ~/.config/gh/hosts.yml, which sits on the ephemeral container layer. Every rebuild logged the user out, unlike ~/.claude, which is on a volume.

Changes

• Default devcontainer.json:
  • Removed the dangling waitFor. Its default, updateContentCommand, is correct.
  • Guarded bun install with if [ -f package.json ].
• Sandbox devcontainer.json: the same bun install guard, plus init-plugins.sh (if present) at the end of postCreateCommand. That runs before postStartCommand brings up the firewall, matching the repo-root sandbox.
• Both variants:
  • New myproject-gh-config-${localWorkspaceFolderBasename} volume at /home/node/.config/gh, shared between the variants by name.
  • The chown safety net now covers it too.
• Dockerfile: pre-creates /home/node/.config/gh, owned by node, next to the other mount points. Docker then seeds a fresh volume with node ownership instead of root. Checked by experiment: without this the mount comes up root-owned.
• CI verify (ci.yml, build-claude-code.yml): asserts stat -c %U /home/node/.config/gh is node for both variants.
• README, init-plugins.sh header: document the gh volume and how init-plugins.sh runs in each variant.

Notes

• Why claude-code template: waitFor points at an undefined postCreateCommand, and updateContentCommand's unguarded bun install breaks package.json-less consumers #107 option (b) and not (a) for the default variant. Option (a), wiring init-plugins.sh into postCreateCommand, is exactly the setup fix(devcontainer): theme, login, node_modules isolation, self-contained claude-code config #58 removed. Before 6c72403 the repo-root default ran init-plugins.sh from postCreateCommand with waitFor: postCreateCommand already set. The claude CLI calls raced the Claude Code extension's OAuth sign-in and corrupted auth state. So the default variant now says "run bash .devcontainer/init-plugins.sh once after signing in", which is also what the repo-root default says. The branch's first commit tried (a); the second reverts that part, with the reasoning in its message.
• The sandbox keeps the script in postCreateCommand, because interactive OAuth can't run behind its firewall anyway.
• Verification:
  • Both JSONC files parse.
  • The bun install guard exits 0 in an empty dir and runs bun install when a package.json exists (tested in claude-code:latest).
  • The script guard exits 0 when the file is absent.
  • hadolint v2.12.0 (CI's version), actionlint and shellcheck all pass.
• Not verified locally: a full docker build of the image (deb.debian.org was unreachable from this host's Docker), and a live VS Code create/rebuild. CI's build and verify steps are the first real test of the Dockerfile change.
• The "baked monorepo node_modules dirs" note in claude-code template: waitFor points at an undefined postCreateCommand, and updateContentCommand's unguarded bun install breaks package.json-less consumers #107 is out of scope.

Fixes #107
Fixes #114