Upgrade agents dev container Feature to v3

[arv]

What

Upgrades both dev container templates to v3 of the rocicorp/devcontainer-features/agents Feature.

agents v3.0.0 is a breaking release: it drops the bundled GitHub CLI (gh) and 1Password CLI (op), so the container no longer injects a GitHub token (or 1Password credentials) at shell start. Migration note: https://github.com/rocicorp/devcontainer-features#agents

Changes

Pin bump (:1 → :3) — applied to every devcontainer.json in the repo:

• src/node/.devcontainer/devcontainer.json
• src/sibling-services/.devcontainer/devcontainer.json

Both were on :1 (not :2). The pnpm:1 pins are left alone (still on their current major). No codexVersion option was present, so nothing to preserve there.

Dead-wiring removal — dropped the now-inaccurate + gh from the feature-description comment in both files. That comment was the only gh/op reference tied to the bundled tooling.

Dependabot — added .github/dependabot.yml with a devcontainers ecosystem entry (weekly, all feature updates grouped). Because the configs live under src/<template>/.devcontainer/ rather than a root .devcontainer/, it uses directories: ["/src/node", "/src/sibling-services"] so Dependabot finds both.

No devcontainer-lock.json exists beside either config, so there was no lockfile to regenerate.

Risk: risk-free ✅

Nothing inside the container uses gh or op:

• postCreateCommand in both templates is just pnpm install.
• No remoteEnv / ${localEnv:...} token passthrough, no GITHUB_TOKEN, no OP_SERVICE_ACCOUNT in any devcontainer config.
• The only GITHUB_TOKEN in the repo is in .github/workflows/release.yml — the standard GitHub Actions token used to publish templates to ghcr.io. That runs in CI, not inside the dev container, so it is unrelated to the dropped bundled gh and was left untouched.

Because no in-container script or lifecycle command depended on the bundled gh/op, the official github-cli Feature was not re-added. Dropping the token wiring is therefore a no-op for behavior.

Verification

• Re-grepped: no agents pin still reads :1/:2; no orphaned gh/op/1Password/GITHUB_TOKEN references remain in the templates.
• Both devcontainer.json files still parse (JSONC) and dependabot.yml is valid.
• Diff is minimal — only the comment line and pin line per config, plus the new Dependabot file.

---

Generated by Claude Code