ci(devcontainer): mount the history file, not the host home

[KaiSchwarz-cnic]

Part of RSRMID-3052 — a fleet-wide fix. This frame mounted ${localEnv:HOME} at /WSL_USER to reach one file inside it, ~/.zsh_history. That granted the container read-write reach over the host's SSH keys, shell profiles and every other repository on the machine.

Why this is more than untidy

In the workspace repository the same pattern made the readonly flag on its GitHub token directory decorative — the same inodes were reachable read-write by the second path, verified there by inode before the fix:

readonly  /home/vscode/.config/rtldev-middleware-workspace/tokens
WRITABLE  /WSL_USER/.config/rtldev-middleware-workspace/tokens

1454160 /home/vscode/.config/rtldev-middleware-workspace/tokens/centralnicgroup
1454160 /WSL_USER/.config/rtldev-middleware-workspace/tokens/centralnicgroup

That workspace fix is merged and verified after a rebuild: no host-home mount remains, and writes to the token directory now fail.

What changed here

The bind names the single file at the same path, and initializeCommand touches ~/.zsh_history so Docker cannot create a directory where the file belongs — on the host, where it would outlive the container.

A pre-existing defect found on the way, and recorded rather than fixed

Nothing here currently reads that path. post-create.sh says symlinking ~/.zsh_history out of /WSL_USER "is devbase's job now" — but this frame never lists the devbase Feature, so nothing does it. The script stopped and the Feature never started, which means this repository has no shell-history persistence at all today.

Not fixed here: completing that migration is its own change, and this PR deliberately only stops the mount being wider than it needs to be. The comment in the frame now records it so the next reader is not misled by the post-create.sh note.

Also

Drops the GitHub.copilot extension, deprecated for us since the team works with Claude; anthropic.claude-code stays. Unrelated to the mount change, in the same commit only because it edits the same few lines of the same file.

[KaiSchwarz-cnic]

🧪 Testing is red for a reason unrelated to this PR

The failures are IDNA transitional-processing expectations, across every Python version in the matrix:

tests/test_idnaconverter.py::test_convert_single_transitional_domain FAILED
>       assert converter.get_pc() == "fass.de"
E       AssertionError: assert 'xn--fa-hia.de' == 'fass.de'
E         - fass.de
E         + xn--fa-hia.de

That is the German sharp s (ß): fass.de is what transitional UTS-46 processing yields (ß → ss), xn--fa-hia.de is non-transitional IDNA2008, which preserves ß. The library now returns non-transitional; the tests still expect transitional.

This cannot be caused by this PR — the diff is a single file, .devcontainer/devcontainer.json. 🧪 Linting passes.

Deliberately not fixed here, because it is not a mechanical fix. Whether these expectations should be updated to non-transitional, or the library pinned/configured to keep transitional processing, is a product decision about what this SDK promises for ß domains — transitional processing is deprecated in UTS-46, but changing what the converter returns is a behaviour change for callers. That needs a human decision and its own ticket, not a green-the-build edit.

Same class as two others found during this fleet-wide sweep: pnpm 12 making --frozen-lockfile strict (fixed in devcontainer-features#12) and golangci-lint 1.26 crashing on Go 1.27 sources (go-sdk#248). All three are a floating dependency moving while a pinned expectation stayed.