Install gh CLI and Copilot CLI with persisted config

Adds gh via upstream's apt repo (auto-updating, signed by GitHub's key)
and the Copilot CLI via gh.io/copilot-install. Both drop home-persist
manifests so logins and extension state survive workspace rebuilds:
.config/gh/ + .local/share/gh/ for gh, .copilot/ for Copilot CLI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chapterjason

scripts/copilot/install.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# GitHub Copilot CLI installer. Runs as the workspace user — the upstream
+# installer drops the binary into $HOME/.local/bin/copilot (on PATH via
+# claude-code's .profile hook). Requires an active Copilot subscription at
+# runtime; the install itself needs no auth.
+# https://gh.io/copilot-install
+set -e
+
+curl -fsSL https://gh.io/copilot-install | bash
+
+if [ ! -x "$HOME/.local/bin/copilot" ]; then
+  echo "copilot: expected $HOME/.local/bin/copilot after install, but it was not found." >&2
+  exit 1
+fi
+
+# Persist Copilot CLI state across workspace rebuilds. ~/.copilot holds
+# config.json (auth + settings), session-state/ (chat history, checkpoints),
+# and logs/ — persist the whole dir so logins and sessions survive.
+sudo mkdir -p /etc/home-persist.d
+sudo tee /etc/home-persist.d/copilot.json >/dev/null <<'EOF'
+{
+  "source": "copilot",
+  "paths": [".copilot/"]
+}
+EOF

scripts/gh/install.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# GitHub CLI installer. Runs as root. Adds cli.github.com's apt repo and
+# installs gh system-wide — the upstream-recommended path on Debian.
+# https://github.com/cli/cli/blob/trunk/docs/install_linux.md
+set -e
+
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+  -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
+chmod a+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+
+echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+  > /etc/apt/sources.list.d/github-cli.list
+
+apt-get update
+apt-get install -y --no-install-recommends --no-install-suggests gh
+rm -rf /var/lib/apt/lists/*
+
+# Persist gh config + extensions across workspace rebuilds. ~/.config/gh
+# holds config.yml and hosts.yml (auth tokens); ~/.local/share/gh holds
+# anything installed via `gh extension install`.
+mkdir -p /etc/home-persist.d
+cat > /etc/home-persist.d/gh.json <<'EOF'
+{
+  "source": "gh",
+  "paths": [".config/gh/", ".local/share/gh/"]
+}
+EOF

src/base/Dockerfile

@@ -87,6 +87,8 @@ RUN --mount=type=bind,source=scripts/home-persist,target=/scripts/home-persist \
     bash /scripts/home-persist/install.sh
 RUN --mount=type=bind,source=scripts/icu,target=/scripts/icu \
     bash /scripts/icu/install.sh
+RUN --mount=type=bind,source=scripts/gh,target=/scripts/gh \
+    bash /scripts/gh/install.sh
 RUN --mount=type=bind,source=scripts/jetbrains,target=/scripts/jetbrains \
     bash /scripts/jetbrains/install.sh
 
@@ -97,6 +99,8 @@ RUN --mount=type=bind,source=scripts/nvm,target=/scripts/nvm \
     bash /scripts/nvm/install.sh
 RUN --mount=type=bind,source=scripts/claude-code,target=/scripts/claude-code \
     bash /scripts/claude-code/install.sh
+RUN --mount=type=bind,source=scripts/copilot,target=/scripts/copilot \
+    bash /scripts/copilot/install.sh
 RUN --mount=type=bind,source=scripts/rtk,target=/scripts/rtk \
     bash /scripts/rtk/install.sh
 RUN --mount=type=bind,source=scripts/web-shell,target=/scripts/web-shell \