Replace curl|sh oh-my-zsh install with pinned shallow git fetch in devcontainer

[Copilot]

The devcontainer Dockerfile executed a remote install script via curl | sh, creating a supply-chain RCE risk if the upstream URL or connection was compromised.

Changes

• Remove curl | sh: Replace sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" with git init + git fetch --depth 1 + git checkout FETCH_HEAD — no remote script is executed
• Pin to a specific commit: OMZ_COMMIT=8df5c1b18b1393dc5046c729094f897bd3636a9b (master HEAD, 2026-03-10); shallow fetch limits clone size and reachable history
• Overridable at build time via ARG OMZ_COMMIT for easy upgrades

ARG OMZ_COMMIT=8df5c1b18b1393dc5046c729094f897bd3636a9b
RUN if [ ! -d /home/vscode/.oh-my-zsh ]; then \
        git init /home/vscode/.oh-my-zsh \
        && git -C /home/vscode/.oh-my-zsh fetch --depth 1 \
            https://github.com/ohmyzsh/ohmyzsh.git "${OMZ_COMMIT}" \
        && git -C /home/vscode/.oh-my-zsh checkout FETCH_HEAD; \
    fi \
    ...

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.