Test the dev container in every pull request that changes it, the job included #34

Goal

Every pull request that changes the dev container, the job that tests it included, proves it still builds, starts
and gives a working environment. Every other pull request skips that test.

Acceptance Criteria

• Devcontainer Build runs when a pull request changes anything under .devcontainer/, or
  .github/workflows/validate.yaml, which holds the job.
• After post-create, the job checks something real inside the container: the SDK imports from the environment
  post-create's uv sync built. Today it runs echo.
• Any other pull request skips the job, as today.
• Validate Status fails when Detect Changes fails, or when a job it waits on is cancelled. Today a failed
  Detect Changes skips every job and the status still passes.

Context

Validate already scopes the build: Detect Changes (dorny/paths-filter) runs Devcontainer Build
(devcontainers/ci, which builds, starts and runs runCmd) only when the devcontainer filter matches. Three gaps
remain:

• The filter lists six paths under .devcontainer/ by name, so a new file there, such as a Features lockfile,
  wouldn't trigger the build. Nor does a change to validate.yaml, so a pull request that edits the job itself
  merges without running it.
• runCmd is echo "devcontainer smoke test passed", so the job checks nothing that post-create left behind.
• Validate Status doesn't wait on Detect Changes.

What counts as a dev container change:

Not inputs: pyproject.toml and uv.lock (post-create runs uv sync, but CI installs from them the same way),
Taskfile.yml, lefthook.yml, the code and the docs.

Main's dev container doesn't build until #33 lands (#30), so the job fails on any pull request that triggers it until
then.

The reference is the devcontainer job in musher-dev/engineering-conventions' validate.yml.