[amiralis1365]

Closes #34.

Summary

Validate already builds the dev container only when the devcontainer filter matches. This closes the three gaps
left:

• The filter is .devcontainer/** plus this workflow. It listed six paths under .devcontainer/ by name, so a
  new file there, such as a Features lockfile, didn't trigger the build. Nor did a change to validate.yaml, so a
  pull request that edited the build job merged without running it. This pull request is one: under the old filter
  its own run would have skipped the build.
• runCmd checks something. It was echo "devcontainer smoke test passed". It now runs
  .venv/bin/python -c 'import musher' inside the container after post-create, which proves the uv sync post-create
  ran left a working environment. up still proves the build and every lifecycle script, post-create's
  base_verify_tools included.
• Validate Status waits on Detect Changes. When Detect Changes failed, every job was skipped and the status
  passed. It now fails then, and on a cancelled job too.

The two actions this touches are pinned to the commits their tags resolve to today, so nothing they run changes:
dorny/paths-filter@ceb8a2b… (v4 = v4.0.3) and devcontainers/ci@513af61… (v0.3 = v0.3.1900000450). These
are the same pins platform, host-agent and pelorus use.

No GitHub token goes into the container. Nothing in this repository's lifecycle scripts calls the GitHub API: they
don't use mise, and Claude Code, Codex and lefthook come from their own installers and npm.

No ruleset requires a check here (only a review), so Validate Status reports rather than blocks.

Main's dev container doesn't build until #33 lands (#30: base:ubuntu now resolves to Ubuntu 26.04, which the
docker-in-docker Feature refuses). This pull request's own Devcontainer Build therefore fails until then. That
failure is the test working. Merge #33 first, then update this branch.

What counts as a dev container change

Path	What reads it
.devcontainer/**	the dev container itself: devcontainer.json, .env.example, the compose stack and its config, the lifecycle scripts
.github/workflows/validate.yaml	holds the job that runs the test

Not inputs: pyproject.toml and uv.lock (post-create runs uv sync, but CI installs from them the same way),
Taskfile.yml, lefthook.yml, the code and the docs.

What stays the same

• ShellCheck, Compose Config and their scripts and compose filters. chore(devcontainer): keep more state across rebuilds #33 edits those lines, and this change
  merges cleanly with it (git merge-tree).
• The build itself: same action and inputs, cacheFrom included.
• A push to main is still scoped by its own diff (dorny/paths-filter compares a push with the commit before it).

Test plan

• actionlint 1.7.12 with shellcheck 0.11.0 on PATH: clean.

• The old and new filter, emulated on this repository's history:

  Change	Old filter	New filter
  33b43ca (.devcontainer/ files)	build	build
  main's tip (release 0.3.5)	skip	skip
  this pull request (validate.yaml only)	skip	build

• git merge-tree against chore(devcontainer): keep more state across rebuilds #33: clean. Against Dependabot's chore(deps): Bump the github-actions group across 1 directory with 4 updates #28 (checkout v6 → v7): one conflict, on the line beside
  dorny/paths-filter. Dependabot rebases its own pull request when that happens.

• This pull request changes validate.yaml, so its own run builds and starts the dev container. It fails until chore(devcontainer): keep more state across rebuilds #33
  lands, as described above.

🤖 Generated with Claude Code