feat(claude-code): bake gh-stack extension and add stacked-PRs skill

[gatezh]

What

Bakes the official github/gh-stack gh extension into the claude-code images and the repo-root devcontainer, and adds a stacked-prs skill that tells agents to use native stacked PRs.

Why

Agents fell back to hand-chaining PRs with gh pr create --base, and GitHub can't merge that kind of chain atomically. A runtime gh extension install writes to ~/.local/share/gh on the container overlay, and only ~/.config/gh is a volume, so the extension disappears on every rebuild. In claude-sandbox the firewall probably blocks the runtime install too. Installing at build time fixes both problems.

Changes

• Dockerfiles: claude-code/.devcontainer/Dockerfile (in base, so both default and sandbox get it) and the root .devcontainer/Dockerfile run gh extension install github/gh-stack --pin "v${GH_STACK_VERSION}" as node.

  • In claude-code, the step sits just before the Claude Code install, so daily claude-code bumps don't re-run it.
  • A comment says that a volume over ~/.local/share/gh would hide the baked copy.

• Renovate: GH_STACK_VERSION gets a # renovate: datasource=github-releases depName=github/gh-stack annotation. The ARG holds the bare version, like GH_VERSION, and extractVersion strips the v. github/gh-stack joins the "devcontainer tools" group, which auto-merges after a 3-day soak.

• CI: gh stack --version is added to the claude-code verify commands in ci.yml (PR time) and build-claude-code.yml (post-build, amd64 and arm64, both variants).

• Skill: new claude-code/.claude/skills/stacked-prs/SKILL.md covering:

  • init/add/submit --auto for new work
  • link <bottom>…<top> for PRs that already exist
  • merge <pr> --yes for an atomic merge up to that PR
  • the non-interactive flags and --remote when there are several remotes
  • never hand-chaining --base PRs

  It is named stacked-prs so it doesn't clash with the upstream gh-stack skill, which it points to. The skill is added to the devcontainer-upstream-sync manifest, and that skill goes to version 1.2.0.

• Docs: claude-code/README.md gets a What's Included row, the Automatic Rebuilds list, a skill section, the file tree and the Build Args table. The root README's Renovate paragraph also mentions gh-stack.

Notes

• gh extension install works without authentication at build time. It was checked in a container from the published image with no GH_TOKEN (exit 0, gh stack --version → gh stack version 0.1.1). It does call api.github.com without a token, so the 60 requests/hour per-IP rate limit applies during the build.
• The verify step uses gh stack --version rather than gh extension list, because gh extension list fails without gh auth.
• The release publishes no checksums file, only API asset digests. The install is pinned by tag, and there is no checksum verification, the same as rtk, ralphex and the gh .deb.
• The firewall allowlist option from the issue is out of scope.
• Not built locally: Docker Desktop's VM disk on the dev host was full, so no image build ran. hadolint 2.12.0 (CI's version), actionlint and renovate-config-validator all pass, and the install and every skill command were checked in a container from the published image. CI's build-and-verify is the first full build.
• Merge order with feat(claude-code): upgrading-dependencies skill; sync skill 1.2.0 #136: both PRs bump devcontainer-upstream-sync to 1.2.0. Whichever merges second should bump to 1.3.0.

Fixes #160