[devcontainers]: Define devcontainer spec extension for hawkeye policy injection

Issue: [devcontainers]: Define devcontainer spec extension for hawkeye policy injection

Feature: devcontainers
Priority: high
Labels: devcontainers, hawkeye, high-priority

Description

Currently hawkeye policy and devcontainer definitions are separate. When a devcontainer is launched for agent work, hawkeye has no structured way to know which policies apply to that container context. We need a standard extension to the devcontainer spec that declares hawkeye policy bindings — so the container itself encodes what rules govern the agent running inside it.

Intel driver: Martin Fowler's harness engineering article (2026-04-02, martinfowler.com) — "outer harness serves two goals: increases the probability the agent gets it right AND provides a feedback loop that self-corrects." The harness starts at the container definition level.

What

Define a devcontainer.json extension schema:

{
  "hawkeye": {
    "policySet": "daax/standard-v1",
    "qualityGates": ["test-coverage-80", "no-secrets", "lint-pass"],
    "feedbackMode": "adaptive",
    "maxAutoCorrections": 3
  }
}

Why

Container-declared policy means: (1) policy travels with the code, not just the repo config; (2) any agent spawned in that container automatically inherits the right hawkeye ruleset; (3) policy can be version-controlled alongside the container definition.

Definition of Done

• Schema defined and documented in daax devcontainers spec
• devcontainer startup sequence reads hawkeye block and registers policy with hawkeye before first agent command
• If hawkeye block is absent, container starts with default policy (not no policy)
• Validation: daax dev validate catches invalid hawkeye policy refs at startup, not at runtime
• Test: container with "qualityGates": ["test-coverage-80"] causes hawkeye to reject code submissions below 80% coverage
• Documentation: annotated devcontainer.json example with hawkeye block

Start by locating the devcontainer.json handling and the devcontainer startup sequence, then trace the daax dev validate entry point. Define the schema and policy registration behavior against the listed Definition of Done, and add the requested container validation test plus an annotated devcontainer.json example.