fix(devcontainer): repair postCreateCommand and pin Feature versions

.devcontainer/README.md

@@ -33,6 +33,25 @@ once, and the volume keeps it.
 3. Reinstall any apt packages you use (see the example below) — their auth and
    config are already on the volume.
 
+## Feature versions are pinned (lockfile)
+
+[devcontainer-lock.json](devcontainer-lock.json) pins the exact versions of the
+Dev Container Features (`node`, `git`) referenced by
+[devcontainer.json](devcontainer.json), the same way `package-lock.json` pins
+npm dependencies. Without it, `node:1` / `git:1` resolve to the newest upstream
+release on every image build, and any new Feature release invalidates the
+Docker layer that installs them — turning the next container create into a
+multi-minute rebuild (several `apt` rounds plus the node toolchain install).
+With the lockfile committed, image builds keep hitting the cached layer until
+the pins are deliberately updated:
+
+```bash
+npx @devcontainers/cli upgrade --workspace-folder .
+```
+
+Commit the updated lockfile afterwards. (Deleting the lockfile and rebuilding
+has the same effect, minus the reproducibility.)
+
 ## Example: one developer's loadout (Claude Code + GitHub CLI)
 
 An example of setting up personal tooling so that it persists. Substitute your

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,14 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "1.3.8",
+      "resolved": "ghcr.io/devcontainers/features/git@sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2",
+      "integrity": "sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2"
+    },
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "1.7.1",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:8c0de46939b61958041700ee89e3493f3b2e4131a06dc46b4d9423427d06e5f6",
+      "integrity": "sha256:8c0de46939b61958041700ee89e3493f3b2e4131a06dc46b4d9423427d06e5f6"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -15,7 +15,7 @@
 	// Use 'forwardPorts' to make a list of ports inside the container available locally.
 	// "forwardPorts": [],
 	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "npm install && npm run build:lib && cd packages/openbridge-webcomponents && npx playwright install --with-deps chromium",
+	"postCreateCommand": "npm install && cd packages/openbridge-webcomponents && npm run build && npx playwright install --with-deps chromium",
 	// Persist the container user's home directory across rebuilds (named Docker
 	// volume). Tool-agnostic developer convenience: anything installed into
 	// $HOME survives "Rebuild Container" — per-developer AI/CLI tooling and its