ci: merge devcontainer-check into build-checks

[nozaq]

Folds devcontainer-check.yml into build-checks.yml, and builds each sandbox dev container from the job that already builds its image instead of from scratch.

Motivation

Since #214 moved the Dev Container Feature tests into build-checks.yml and decolint into lint.yml, and #224 narrowed build-checks.yml to the changed images, devcontainer-check.yml was left building every sandbox on every */Dockerfile or */smoke-test.sh change, with no change detection of its own, and rebuilding each image a second time from scratch on its own runner.

A change under node/ now builds one sandbox instead of ten, as a step in a job that has already built that image.

Changes

• Build the sandbox dev container in check-base and check-image rather than in a separate job, on both architectures as with the Feature tests next to it. Read build args exports the arguments the build step used, so the Dev Container CLI resolves the same Dockerfile, context and arguments and reuses those layers. Context matches because the CLI defaults build.context to the Dockerfile's parent directory (getDockerContextPath returns parentURI(getDockerfilePath(...))), which is what docker/build-push-action is given.
• Read the sandbox build args from the environment through ${localEnv:...}, with no defaults, matching feature-debian. That drops the pinned copy of every build arg from the sandbox configurations, leaving build.yaml as their only source, and with it the Renovate rules that kept the two in sync.
• Stop repeating the smoke tests in the sandbox step. With identical arguments the image is the one the previous step already smoke-tested, so the step asserts only what the configuration adds on top of it: that the CLI applies remoteUser.
• Delete devcontainer-check.yml. Its path filters (*/Dockerfile, */smoke-test.sh) were already covered by build-checks.yml; .devcontainer/sandbox-** is added there.
• Stop ignoring .devcontainer/sandbox- in changed-images.sh, and map each sandbox directory to its image the same way the Feature configurations are already mapped.
• Add a Verify sandbox configurations step to setup: every image must have a sandbox, and each sandbox must declare exactly the build args of its image. Neither is tied to a changed image, and a mismatch would leave an argument resolving to the empty string rather than fail outright.
• Document in AGENTS.md how to export the arguments when opening a sandbox by hand.

Trade-off

Opening a sandbox now requires exporting the build args first; without them the build fails on an empty argument. This is the feature-debian trade-off applied to the sandboxes: a missing value fails rather than silently selecting a different version. Defaults were considered and rejected — the CLI splits the substitution on every colon (variable.split(':') in evaluateSingleVariable, default taken from args[1]), so a Debian digest default would be truncated to trixie-20260725@sha256, and keeping pinned values would also require reworking the devcontainer.json patterns in renovate.jsonc.

Verification

No Docker daemon was available, so the sandbox steps need a CI run to confirm. The thing to watch on the first run is whether the Dev Container CLI build actually hits the buildx cache from the build step. If it does not, those jobs get slower rather than faster, since the work is now serial within a job instead of parallel across jobs.

Checked locally:

• changed-images.sh selection for a sandbox-only change, .md exclusion, debian/smoke-test.sh (cross-image), a Feature configuration change, and the repository-wide catch-all.
• The Verify sandbox configurations guard, on the current tree and on three seeded failures: an orphan sandbox directory, a sandbox missing an argument, and a build arg removed from build.yaml. All three exit non-zero with a diff naming the file.
• Every image uses the same build_args keys across all of its variants, so one sandbox configuration covers each image's whole matrix.
• build-checks.yml YAML parse and step order; renovate.jsonc and all ten sandbox configurations parse; bash -n on changed-images.sh.

base_matrix and matrix generation could not be reproduced locally because the available yq is the Python implementation, but that code path is unchanged.