fix(devcontainer): use cp instead of symlinks for workflow install

Symlinks into a temp directory broke when the directory was deleted
after postinstall completed. Copying files ensures workflows persist.
Also updates stale comments and retains ls -l for diagnostics.

Author: johnzook

image/scripts/update-keystone.sh

@@ -5,8 +5,8 @@ set -euo pipefail
 UPDATE_FAILURES=0
 
 echo "Updating keystone packages..."
-# Note: bun global installs may change symlink targets from ~/.local/lib to ~/.bun/install/global
-# This is acceptable - postinstall.sh uses ln -sf to cleanly overwrite existing symlinks
+# Note: bun global installs may change paths from ~/.local/lib to ~/.bun/install/global
+# This is acceptable - postinstall.sh uses cp -f to overwrite existing files
 
 if ! bun install -g github:ZookAnalytics/keystone-cli; then
   echo "⚠ keystone-cli update failed, using existing version"
@@ -37,7 +37,7 @@ if [ -f "$WORKFLOWS_PKG" ]; then
 else
   echo "keystone-workflows: (installed via bun global)"
 fi
-echo "workflows path: $(ls -la ~/.keystone/workflows/*.yaml 2>/dev/null | head -1 || echo 'not found')"
+echo "workflows path: $(ls -l ~/.keystone/workflows/*.yaml 2>/dev/null | head -1 || echo 'not found')"
 
 # Report update status (exit 0 for graceful degradation per AC5)
 if [ "$UPDATE_FAILURES" -gt 0 ]; then

packages/keystone-workflows/scripts/postinstall.sh

@@ -16,13 +16,12 @@ if [ ! -d "$CONFIG_DIR" ]; then
 fi
 
 # 1. Install workflows to ~/.keystone/workflows/
-# Uses ln -sf to force-overwrite existing symlinks (handles updates cleanly)
 WORKFLOW_TARGET="$HOME/.keystone/workflows"
 mkdir -p "$WORKFLOW_TARGET"
 WORKFLOW_COUNT=0
 for f in "$WORKFLOWS_DIR"/*.yaml; do
   [ -e "$f" ] || continue  # Handle no matches
-  ln -sf "$f" "$WORKFLOW_TARGET/$(basename "$f")"  # -f overwrites existing
+  cp -f "$f" "$WORKFLOW_TARGET/$(basename "$f")"
   WORKFLOW_COUNT=$((WORKFLOW_COUNT + 1))
 done
 if [ "$WORKFLOW_COUNT" -eq 0 ]; then