DAP cutover (M5): replace @devcontainers/cli shell-out in apps/runtime #1

The original mandate. Wire `devcontainer-go` into DAP's `apps/runtime/internal/devcontainer/` behind a feature flag, replace the six CLI call sites, then delete the Node + `@devcontainers/cli` runtime dependency.

Phases

• Phase 0: vendor `devcontainer-go` v0.x in DAP's `go.mod`
• Phase 1: swap `internal/devcontainer/lifecycle.go` (`Start` + `WaitForReady`) behind a flag
• Phase 2: swap `exec.go` (`ExecWorkd`) and the readiness probe
• Phase 3: swap `postcachebuild.go` (`read-configuration` → `engine.Resolve`, `exec` → `engine.Exec`)
• Phase 4: flip default to `go`, run a release cycle, delete the CLI path

Acceptance

• DAP runs against the Go engine in a release cycle without regressions
• Node + `@devcontainers/cli` removed from the runtime image

Related

• Driving spec: `design/status.md` and PRD §10 (internal docs)