Address Copilot review: idempotent git setup, honest nixpkgs wording

- setup-git.sh: stop truncating .gitconfig.local on every run. Use
  `git config --file --replace-all include.path` so other global keys a
  user writes inside the container (e.g. core.editor) are preserved,
  making the script genuinely idempotent. The no-host branch unsets a
  stale include instead of wiping the file.
- Dockerfile: reword the nixpkgs registry comment — nixos-25.05 is a
  release branch, not a frozen revision; clarify it only governs
  container bootstrap tooling while the project toolchain is pinned via
  flake.nix/flake.lock.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: RaoulSchaffranek

.devcontainer/Dockerfile

@@ -45,8 +45,11 @@ RUN curl -fsSL "https://releases.nixos.org/nix/nix-${NIX_VERSION}/install" -o /t
 
 ENV PATH=/home/vscode/.nix-profile/bin:/home/vscode/.npm-global/bin:$PATH
 
-# Pin the `nixpkgs` flake to nixos-25.05 (matches the project's flake.nix), then
-# install only the container-level bootstrap/runtime tooling via Nix:
+# Point the `nixpkgs` flake registry at the nixos-25.05 release branch (matching
+# the project's flake.nix) — a stable channel, though not a frozen revision; it
+# only governs the container-level bootstrap tooling below, while the project
+# toolchain is pinned reproducibly via flake.nix/flake.lock. Then install only
+# that container-level bootstrap/runtime tooling via Nix:
 #   - direnv + nix-direnv → auto-load and cache the flake's `nix develop` shell on
 #                           entry to /workspace; this is what actually provides the
 #                           project toolchain (python, uv, make, wabt, K Framework),

.devcontainer/setup-git.sh

@@ -17,14 +17,23 @@ set -euo pipefail
 host_gitconfig="/home/vscode/.gitconfig"
 local_gitconfig="/home/vscode/.gitconfig.local"
 
+# Ensure the writable global config exists without truncating it — a previous run
+# (or the user) may have written real settings here (e.g. core.editor), and this
+# script must not clobber them.
+touch "${local_gitconfig}"
+
 if [ -f "${host_gitconfig}" ]; then
     # Host provided a ~/.gitconfig (bind-mounted as a regular file): inherit it.
-    printf '[include]\n\tpath = %s\n' "${host_gitconfig}" > "${local_gitconfig}"
+    # Set just the include.path key via `git config` so any other keys the user
+    # already wrote to the global config are preserved. --replace-all collapses
+    # the entry to a single value, keeping the operation idempotent across re-runs.
+    git config --file "${local_gitconfig}" --replace-all include.path "${host_gitconfig}"
     echo "setup-git: global config includes host identity from ${host_gitconfig}"
 else
     # No host ~/.gitconfig — the missing bind source is materialized as an empty
-    # directory, which must NOT be included. Leave an empty writable global.
-    : > "${local_gitconfig}"
-    echo "setup-git: no host ~/.gitconfig found; created empty ${local_gitconfig}"
+    # directory, which must NOT be included. Drop any stale include.path we may
+    # have added on an earlier run, but leave every other key untouched.
+    git config --file "${local_gitconfig}" --unset-all include.path 2>/dev/null || true
+    echo "setup-git: no host ~/.gitconfig found; using empty ${local_gitconfig}"
     echo "setup-git: set your identity with 'git config --global user.name ...' / user.email"
 fi