feat(devcontainer): add public Classic shader image tools - #39

Summary

Closes #38

Make the governed Classic Linux image a deterministic, public shader-capable
build and coverage environment. The image will provide the qualified DXC and
SPIRV-Cross tools needed by Classic's GPU shader pipeline, while retaining
immutable image publication and fork-safe validation boundaries.

Implementation / behavior

• Add the qualified, checksum-locked shader toolchain and its license/input
  metadata to the Classic image contract.
• Install and validate the tools in the slim classic-final image so wrapper
  Classic builds can compile the locked shader cohort without a private or
  host-provided toolchain.
• Keep image candidates addressed by commit and preserve the existing
  validation, SBOM, provenance, and public classic-build publication flow.

Validation

• Validate the machine-readable image/toolchain contracts and Dockerfile
  syntax, including the locked shader inputs and executable checks.
• Run the repository shell/Python tests and the applicable Classic image
  validation path; CI will build and smoke the exact final image candidate.

Limitations / follow-up

• The Classic consumer must adopt the released immutable image digest before
  its fork pull-request workflow can use the new environment; this delivery
  does not modify the separate Classic repository.
• Registry visibility and release promotion remain governed by the existing
  maintainer-controlled package and semantic-release workflow.