devcontainer-lock.json: feature lockfile not produced or honored

## Gap

The spec defines \`devcontainer-lock.json\` for reproducible feature resolution: each feature's resolved digest is recorded so subsequent runs pin to the same content. We have content-addressed caching (\`feature/disk_store.go\`) but no lockfile write/read.

## Expected

- On \`Up\`, after feature resolution, write \`/devcontainer-lock.json\` with each feature's \`ref\` → \`resolvedRef\` (digest).
- On subsequent \`Up\`, prefer the lockfile entry over re-resolving the mutable tag.
- Refresh policy: opt-in flag (e.g. \`UpOptions.RefreshFeatures\`) re-resolves and overwrites.

## Notes

Lower priority for DAP (it pins via pre-baked images), but expected by general spec consumers and the upstream CLI ecosystem.

首先跟踪 Up 的 feature 解析流程以及 feature/disk_store.go 中的内容寻址缓存。确定 UpOptions 可以携带 RefreshFeatures 的位置，以及 configDir 可用的位置。完成的标志是 Up 写入并读取 devcontainer-lock.json 条目，将 ref 映射到 resolvedRef，而刷新时会重新解析并覆盖这些条目。

由索引模型根据 Issue 内容生成。