feat(claude-code): add devcontainer-upstream-sync skill

[gatezh]

Summary

Add a devcontainer-upstream-sync skill to the claude-code template that
teaches Claude Code to keep a downstream project's .devcontainer/ and
bundled .claude/skills/ in step with this repo: audit drift against
upstream, adopt missed changes, draft upstream issues for shared bugs, and
self-update when this skill's version: bumps.

Why

Two recent friction points showed the gap:

• The statsig-firewall bug ([BUG] init-firewall.sh aborts startup: statsig.anthropic.com no longer resolves #94) needed a manual diff of init-firewall.sh
  against upstream and a hand-rolled report.
• The Playwright MCP postStartCommand drift (Playwright MCP plugin can't launch a browser in claude-code-sandbox, and the existing ARM64 patch is broken in claude-code too #85/Bake patch-playwright-mcp.sh into the image so consumer projects don't carry a copy #87/refactor(claude-code): bake patch-playwright-mcp into the image (#87) #88) was missed for
  ~10 days in a downstream project because no automated audit existed.

What's in the skill

• Sync manifest — literal table of which files are tracked, with each
  upstream path and a bucket: framework-track (must match upstream),
  starter-customize (template, drift expected), exemplar (canonical at
  a different upstream path, e.g. init-firewall.sh).
• Customization-preservation rules — volume-name prefix, project-only
  VS Code extensions, runArgs hostname, postStart/postCreate chains,
  allowlist contents — never auto-stripped.
• Four workflows — Audit, Adopt, Draft upstream issue, Self-update.
• Decision flow Graphviz — agent-readable.

Distribution

Same copy-paste model as sandbox-fetch-docs / sandbox-playwright. No
plugin manifest needed — the upstream's deliverable spans Dockerfile,
compose, devcontainer.json, and skills, and the existing template-copy
flow already handles all of those.

Test plan

• From a fresh project, run the three-line bootstrap from the README.
• Trigger the skill ("check upstream devcontainer"); verify the audit
  report covers every manifest row.
• Force a stale version: locally; verify Workflow 4 detects it and
  offers to update.
• Verify the README links resolve on GitHub.