[feat] Official devcontainer feature for CAO

## Summary

Publish an official [devcontainer feature](https://containers.dev/features) that installs CAO + web UI into any devcontainer with a single line:

```json
"features": {
"ghcr.io/awslabs/cli-agent-orchestrator/cao": {
"version": "latest",
"webui": true,
"port": 9889
}
}
```

## Motivation

CAO is designed to orchestrate multiple CLI agents, which is a perfect fit for devcontainers — isolated environments where you can install multiple agent CLIs and run them together. Currently, setting up CAO in a devcontainer requires:

1. Install system deps (tmux, git, curl)
2. `pip install` CAO from GitHub
3. Clone the repo separately to build the web UI (`npm install && npm run build`)
4. Copy the built web UI to the correct location inside the installed package
5. Configure CORS, networking, and agent pre-configuration

A devcontainer feature would reduce this to a single JSON line.

## Proposed Feature Structure

```
features/
└── cao/
├── devcontainer-feature.json
└── install.sh
```

### `devcontainer-feature.json`
```json
{
"id": "cao",
"version": "1.0.0",
"name": "CLI Agent Orchestrator",
"description": "Multi-agent orchestration framework for CLI-based AI coding agents",
"options": {
"version": {
"type": "string",
"default": "latest",
"description": "CAO version (git ref or 'latest')"
},
"webui": {
"type": "boolean",
"default": true,
"description": "Build and include the web UI"
},
"port": {
"type": "string",
"default": "9889",
"description": "Server port"
},
"headless": {
"type": "boolean",
"default": true,
"description": "Auto-configure agents for non-interactive use"
}
},
"installsAfter": [
"ghcr.io/devcontainers/features/node",
"ghcr.io/devcontainers/features/python"
],
"entrypoint": "/usr/local/share/cao/entrypoint.sh"
}
```

### `install.sh`
The install script would handle:
1. System deps (tmux)
2. pip install CAO
3. Web UI build (if `webui=true`)
4. Entrypoint creation for auto-start and headless config

## Companion Features

Individual agent CLI features could also be published:
- `ghcr.io/awslabs/cli-agent-orchestrator/claude-code`
- `ghcr.io/awslabs/cli-agent-orchestrator/codex`
- etc.

These would handle CLI installation + auth config mounting, and could be used independently or with the CAO feature.

## Reference Implementation

We have a working devcontainer feature setup at [cao-poc](https://github.com/ThePlenkov/cli-agent-orchestrator) with features for CAO, Claude Code, Codex, and Devin CLI — all tested in devcontainers on Docker Desktop / WSL2.

## Related

- #152 (Non-interactive/headless mode) — the `headless` option in the feature would use this
- #151 (Configurable CORS) — the `port` option needs CORS to follow
- #149 (Docker bridge IPs) — required for the web UI to work from the host

Start by comparing the cao-poc reference implementation with the proposed features/cao/devcontainer-feature.json and features/cao/install.sh structure. Check the related headless, CORS, and Docker networking issues before implementing the feature options. Done means a devcontainer can install CAO and its web UI from the documented single JSON entry.

Written by the indexing model from the issue text.