chore: check in devcontainer-lock.json

[qw-in]

VSCode now generates devcontainer lockfiles which I've checked in here to help with supply chain hardening.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
arcjet-docs	Ready	Preview, Comment	Jun 12, 2026 9:17pm

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Approved

Rationale: This PR only adds a new devcontainer-lock.json file pinning four devcontainer features to specific versions with sha256 integrity hashes. Lock files improve supply chain security by ensuring reproducible builds and tamper detection. No code changes, no auth/secret/injection surface area. Security review checklist found no concerns.

Summary of Changes

Adds a new .devcontainer/devcontainer-lock.json that pins four devcontainer features (astral.sh-uv, common-utils, github-cli, trunk) to specific versions with sha256 integrity digests for reproducible devcontainer builds.

Notes

Lock files improve supply chain integrity by pinning content-addressable digests. Consider documenting how to regenerate this file (e.g., devcontainer features info/CLI) so contributors can refresh pins without ambiguity.

_{Review: eea476b4 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}