fix(devcontainer): spawn the devcontainer CLI outside the sandbox workspace

[khromov]

Bug

Creating a sandbox from any repo with a root bunfig.toml that declares a preload fails right after "Starting devcontainer…". Repro: https://github.com/khromov/gpuix-svelte (preload = ["./src/plugin.ts"]):

error: [gpuix-svelte] svelte resolved to a build without the custom-renderer API. ...
      at pin_svelte (/home/k/.codebay/instances/<id>/gpuix-svelte/src/plugin.ts:43:13)
✗ Error: devcontainer up did not return a result. See logs for details.

Root cause

devcontainerUp spawned the devcontainer CLI with cwd: workspaceDir. The CLI (devcontainer.js) has a #!/usr/bin/env node shebang, and under Bun node resolves to Bun. Bun loads bunfig.toml from the process cwd (not the script's directory), so it ran the cloned repo's preload before the CLI started.

Security: that's host-side code execution. Any repo URL a user sandboxes could run arbitrary code on the host, outside the container, with the manager's privileges — before devcontainer isolation ever applies. Here it just crashed because deps weren't installed; a malicious preload wouldn't.

Fix

• New devcontainerCwd() (config.server.ts) returns DATA_DIR (created if missing). I picked it over os.tmpdir() because tmpdir is world-writable, so another local user could plant a bunfig.toml there.
• devcontainerUp now spawns from devcontainerCwd(). --workspace-folder, --config and --override-config are all absolute already, so behaviour is otherwise unchanged.
• The devcontainer --version probe (devcontainerCliAvailable) also spawns from devcontainerCwd(), so it doesn't inherit whatever the manager's cwd is. spawnCapture gained an optional cwd.

Audit of the other host spawns: every other Bun.spawn/spawnCapture runs git, gh, docker context, or the browser opener. None of them runs through Bun, and none sets a workspace cwd (git -C <workspace> changes git's directory, not the process cwd). devcontainerUp was the only spawn with a workspace cwd.

Bun has no env var that disables bunfig loading. --config/-c exists, but only when you invoke bun directly. We launch through the CLI's shebang, so we can't pass it, which is why this uses a cwd fix.

Test

devcontainer.isolated.test.ts → devcontainerUp cwd: builds a workspace whose bunfig.toml preload throws, stubs Bun.spawn to capture the cwd devcontainerUp uses, and checks that the cwd is outside the workspace. It then runs a real Bun script from that cwd and expects success. It also checks the fixture really does break a Bun process started inside the workspace. The test fails on main and passes here.