chore: add Copilot cloud sandbox setup with hve-core-all plugin

[JoshLuedeman]

What was added

Three files to give the GitHub Copilot cloud agent (and local dev containers) a sandbox pre-loaded with the hve-core-all Copilot CLI plugin from microsoft/hve-core:

1. .devcontainer/setup-hve-core.sh — shared, best-effort installer used by both the cloud sandbox and dev container. Installs @github/copilot CLI, adds the microsoft/hve-core plugin marketplace, installs hve-core-all@hve-core, then lists installed plugins. Every step falls back to a ::warning:: on failure — nothing here is fatal.
2. .github/workflows/copilot-setup-steps.yml — the copilot-setup-steps job Copilot cloud agent runs before starting work. Checks out the repo, sets up Node 22 and Python 3.12 (matching CI), installs frontend/backend deps (continue-on-error: true), runs the shared install script, then verifies tool versions.
3. .devcontainer/devcontainer.json — a Python 3.12 devcontainer base image with the Node 22 feature added, running the same dependency install + setup-hve-core.sh via postCreateCommand.

All third-party GitHub Actions are pinned to full commit SHAs (with the version as a trailing comment), since this repo's existing workflows do not yet pin and none of them are pinned to SHAs to compare against.

Detected stack

• Frontend: React 19 + TypeScript 5.9 + Vite 7, Fluent UI v9, npm (frontend/package-lock.json)
  • Build: npm run build · Test: npm run test:coverage · Lint: npm run lint
• Backend: Python 3.12+, FastAPI, SQLAlchemy 2.0 async, pip/pyproject.toml (backend/pyproject.toml)
  • Build/install: pip install -e ".[dev]" · Test: pytest tests/ -v --cov=app --cov-fail-under=75 · Lint: ruff check app/
• Infra: Bicep (infra/main.bicep), validated in CI with az bicep build
• Dev environment: ./dev.sh up (Docker Compose: backend + frontend + SQL Server), no existing .devcontainer/
• Commands were sourced from .github/workflows/ci.yml, dev.sh, backend/pyproject.toml, and frontend/package.json.

hve-core-all install result: ✅ SUCCESS (no auth prompt encountered)

Ran .devcontainer/setup-hve-core.sh directly in this (headless, non-interactive) Ubuntu validation environment. Relevant log output:

Installing GitHub Copilot CLI...
npm error code EEXIST
npm error path /usr/local/bin/copilot
npm error EEXIST: file already exists
::warning::copilot CLI install failed
Adding microsoft/hve-core plugin marketplace...
Marketplace "hve-core" added successfully.
Installing hve-core-all plugin...
Plugin "hve-core-all" installed successfully.
Listing installed Copilot CLI plugins...
Installed plugins:
  • hve-core-all@hve-core (v3.3.101)

• The npm install -g @github/copilot step "failed" only because the Copilot CLI binary was already present in this validation sandbox (EEXIST) — the script's non-fatal || echo "::warning::..." handled it as designed and execution continued.
• The marketplace add and plugin install succeeded with zero authentication prompts or errors. copilot plugin list confirms hve-core-all@hve-core (v3.3.101) is installed and available.
• No GITHUB_TOKEN/auth-related failure was observed at any step in this environment. This is the key signal for the fleet rollout: hve-core-all installs cleanly headless when the copilot CLI is already authenticated/available, as it is in the Copilot cloud agent sandbox.

Other validation

• ✅ actionlint .github/workflows/copilot-setup-steps.yml — no findings.
• ✅ jq empty .devcontainer/devcontainer.json — valid JSON.
• ⚠️ devcontainer build was not run — the devcontainer CLI is not available in this validation environment. devcontainer.json was hand-verified against the repo's stack (Python 3.12 base image + Node 22 feature) and mirrors the same setup-hve-core.sh used by the GitHub Actions workflow.

Notes

• Only these three files were added; no existing files were modified.
• The plugin install is intentionally best-effort/non-blocking everywhere (continue-on-error: true in the workflow, || echo/|| true in the script) so setup failures never prevent the sandbox or dev container from starting.
• Auto-merge was not enabled on this PR.