[devcontainers]: Implement readiness probe + pre-flight check before agent execution

Issue: [devcontainers]: Implement readiness probe + pre-flight check before agent execution

Feature: devcontainers
Priority: medium
Labels: devcontainers, reliability, medium-priority

Description

Before an agent begins executing tasks inside a devcontainer, daax should run a pre-flight readiness check: verify all declared tools are available, sandbox constraints are active, required secrets are injected (via SVID, not plaintext), and hawkeye is connected. Agents currently start executing immediately on container start, which can lead to silent failures when tools are missing or the sandbox isn't ready.

Intel driver: LiteLLM credential vault exploit (thehackernews.com, 2026-04-07) — the attack succeeded because agents started executing before secure credential setup was verified. Pre-flight eliminates this window.

What

Implement daax dev preflight that runs before the first agent command:

1. Tool check: all declared tools in devcontainer spec are present and executable
2. Sandbox check: nanofuse isolation is active (not falling back to bare execution)
3. Credential check: all required credentials are present as SVIDs (reject plaintext tokens)
4. Hawkeye check: hawkeye policy is loaded and gate is open
5. Network check: only declared network endpoints are reachable

Why

Fail-fast before the agent starts is infinitely better than failing mid-task with corrupted state. Readiness probes are table stakes in Kubernetes; they should be table stakes for agent containers too.

Definition of Done

• daax dev preflight command runs all 5 checks and reports pass/fail per check
• Container startup blocks agent execution until preflight passes (configurable timeout: default 30s)
• Each failed check emits a structured error with actionable fix message (not just "check failed")
• Test: container with missing declared tool fails preflight at tool-check stage with message naming the missing tool
• Test: container with plaintext API key in env fails credential check with message "use SVID instead"
• Preflight results logged to hawkeye audit trail

Start at the daax dev preflight CLI entry point and the container startup path that currently launches agents. Trace how devcontainer declarations, nanofuse, SVID credentials, hawkeye, and network endpoints are represented. Done means all five checks run before execution, failures identify actionable fixes, startup waits up to the configurable timeout, and tests cover a missing tool and plaintext API key.