Migrate host devcontainer tooling from @devcontainers/cli to deacon

[pofallon]

Summary

Migrate remo's host-side devcontainer tooling from the reference Node.js CLI (@devcontainers/cli) to deacon — our own Rust implementation of the DevContainer CLI.

Motivation

• Drops the Node.js/npm dependency on every provisioned host purely to run devcontainer up/exec. deacon ships as a single static binary (curl-installed), removing the nodejs → npm -g @devcontainers/cli chain from the provisioning path.
• Faster, focused: deacon is "the DevContainer CLI, minus the parts you don't use" — we only use the developer-facing up/exec surface, not feature authoring, which is exactly deacon's target.
• First-party: same org (get2knowio), so we control the roadmap and can file parity gaps upstream.

Current usage inventory

Install (to be replaced):

• ansible/roles/devcontainers/tasks/main.yml — npm install -g @devcontainers/cli
• Listed in npm-global package lists: ansible/{aws,incus,hetzner,proxmox}_site.yml, ansible/{aws,incus,hetzner}_configure.yml
• ansible/README.md (role table + dependency list)

Invocations (devcontainer up / devcontainer exec):

• ansible/roles/user_setup/templates/project-launch.sh.j2:99,101
• ansible/roles/user_setup/templates/devshell.sh.j2:87,92,95,96
• ansible/roles/user_setup/tasks/main.yml:319,347 (devcontainer auto-start block, incl. $_rebuild_flag)

All invocations use the --workspace-folder form.

Scope / tasks

• Add a deacon install path to the devcontainers role (curl install script, pinned version) — replace the npm global install.
• Drop @devcontainers/cli from the npm-global package lists in the 7 site/configure playbooks (and re-evaluate whether nodejs/npm are still needed on the host for anything else).
• Swap devcontainer up/devcontainer exec → deacon up/deacon exec in the three user_setup files above.
• Verify flag parity for the rebuild path ($_rebuild_flag → deacon equivalent of --remove-existing-container / --build-no-cache).
• Update ansible/README.md (role description + dependency list).
• Re-test the full flow on a fresh host AND a host with existing state (Constitution: idempotency) for each provider: project auto-start in zellij, remo shell -p <project>, and --exec.

Open questions / parity to confirm

• Does deacon's up/exec accept the same --workspace-folder semantics and exit codes the launch scripts rely on?
• Rebuild flag mapping for the config-hash-changed rebuild branch in user_setup/tasks/main.yml.
• Version pinning + install method on hosts (curl install.sh; deacon is currently pre-release v0.2.0 — may want --prerelease or a pinned release asset until GA).

Out of scope

• The features/remo-notifier-source/ devcontainer Feature (deacon targets consumers, not feature authoring; this Feature is consumed by whatever CLI builds the container, not invoked by remo directly).
• Any change to remo CLI command surface — this is host-provisioning internal.

[pofallon]

Related: #42 (host-enforced agentsh injection via CLI overlay + per-devcontainer network topology). The overlay seam (--additional-features on devcontainer up / deacon up) lands in the same launch scripts this migration touches — ansible/roles/user_setup/templates/{project-launch,devshell}.sh.j2 and ansible/roles/user_setup/tasks/main.yml — so the two should be coordinated.