Upgrade rocicorp/devcontainer-features/agents to v3 (#64)

agents v3.0.0 is a breaking release that drops the bundled GitHub CLI
(gh) and 1Password CLI (op), so the container no longer injects a GitHub
token (or 1Password credentials) at shell start.

- Bump the agents pin :2 -> :3 in .devcontainer/devcontainer.json
- Remove the now-dead GITHUB_TOKEN passthrough in remoteEnv plus the
  gh/1Password comments. Verified nothing in the repo uses gh or op
  inside the container (no lifecycle command, script, or in-container
  CI), so this is behavior-preserving and github-cli was not re-added.
- Regenerate .devcontainer/devcontainer-lock.json: agents resolves to
  the v3 digest and no longer depends on github-cli, so the standalone
  github-cli lock entry is dropped. claude-code and pnpm are unchanged.
- Add .github/dependabot.yml with a devcontainers entry so feature
  updates are tracked weekly going forward.

Author: arv

.devcontainer/devcontainer-lock.json

@@ -5,18 +5,12 @@
       "resolved": "ghcr.io/anthropics/devcontainer-features/claude-code@sha256:cfc2e7d3e9fd3b9b01f8d5cb158508a884c8c0ede2e23ed10f32dea5d4ffe69a",
       "integrity": "sha256:cfc2e7d3e9fd3b9b01f8d5cb158508a884c8c0ede2e23ed10f32dea5d4ffe69a"
     },
-    "ghcr.io/devcontainers/features/github-cli:1": {
-      "version": "1.1.0",
-      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
-      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
-    },
-    "ghcr.io/rocicorp/devcontainer-features/agents:2": {
-      "version": "2.0.0",
-      "resolved": "ghcr.io/rocicorp/devcontainer-features/agents@sha256:172905cd57fbc946323644a52d5829415c77ff8c6f217594720966efcba11db6",
-      "integrity": "sha256:172905cd57fbc946323644a52d5829415c77ff8c6f217594720966efcba11db6",
+    "ghcr.io/rocicorp/devcontainer-features/agents:3": {
+      "version": "3.0.0",
+      "resolved": "ghcr.io/rocicorp/devcontainer-features/agents@sha256:cb7bb04455faaab8fa55e5d57656be969f0f59657fee8a3320e61badb025a5a3",
+      "integrity": "sha256:cb7bb04455faaab8fa55e5d57656be969f0f59657fee8a3320e61badb025a5a3",
       "dependsOn": [
-        "ghcr.io/anthropics/devcontainer-features/claude-code:1",
-        "ghcr.io/devcontainers/features/github-cli:1"
+        "ghcr.io/anthropics/devcontainer-features/claude-code:1"
       ]
     },
     "ghcr.io/rocicorp/devcontainer-features/pnpm:1": {

.devcontainer/devcontainer.json

@@ -16,19 +16,12 @@
   "workspaceFolder": "/workspaces/hello-zero",
   "shutdownAction": "stopCompose",
   "remoteUser": "node",
-  // Forward the host's GITHUB_TOKEN into the container. Under agents:2, gh
-  // authenticates from this token rather than a persisted login. On the host,
-  // export GITHUB_TOKEN (e.g. from 1Password) before launching VS Code. See
-  // https://github.com/rocicorp/devcontainer-features#gh-auth-via-1password-no-host-side-credentials
-  "remoteEnv": {
-    "GITHUB_TOKEN": "${localEnv:GITHUB_TOKEN}"
-  },
   "features": {
     // Shared rocicorp features (https://github.com/rocicorp/devcontainer-features):
-    //  - agents: Codex (pinned) + Claude Code + gh; persists the Claude login
-    //    across rebuilds; gh uses the forwarded GITHUB_TOKEN.
+    //  - agents: Codex (pinned) + Claude Code; persists the Claude login
+    //    across rebuilds.
     //  - pnpm: corepack-managed pnpm; removes npm/npx to enforce pnpm.
-    "ghcr.io/rocicorp/devcontainer-features/agents:2": {},
+    "ghcr.io/rocicorp/devcontainer-features/agents:3": {},
     "ghcr.io/rocicorp/devcontainer-features/pnpm:1": {}
   },
   "postCreateCommand": "pnpm install"

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      devcontainer-features:
+        patterns: ["*"]