Tracking: example scripts blocked on upstream deacon bugs

This issue tracks the runnable examples under `examples/` whose `exec.sh` smoke
test currently fails because of an *upstream deacon bug*, not because the
example itself is wrong. Each entry links to the specific deacon issue that
needs to land. Tick a box when the corresponding deacon fix merges and the
example's `exec.sh` passes against released deacon (with no
`--mount-workspace-git-root false` workaround).

## Context

The new examples under `examples/` (drafted to exercise spec permutations as
canaries) revealed nine spec-parity gaps in deacon. Each gap has its own issue
filed (#65–#73). This issue is the single place to track *example-level*
progress as those gaps close.

Today, every `up`-based example needs the workaround
`--mount-workspace-git-root false` to avoid #67 silently loading the parent
repo's `.devcontainer/devcontainer.json`. Closing #67 alone unblocks the bulk
of the matrix.

## Examples blocked on deacon bugs

| Example | Blocked by | Symptom |
|---|---|---|
| - [ ] `configuration/extends-chain-cycle` | [#65](https://github.com/get2knowio/deacon/issues/65), [#66](https://github.com/get2knowio/deacon/issues/66) | Test "passes" today, but only because filename validation / workspace-folder gating triggers *before* the cycle resolver does. Once #65 and #66 land, the assertion will exercise the real cycle code path. |
| - [ ] `configuration/secrets-declarative` | [#72](https://github.com/get2knowio/deacon/issues/72) | `secrets.GITHUB_TOKEN` missing from resolved configuration. |
| - [ ] `doctor/gpu-host-requirements` | [#66](https://github.com/get2knowio/deacon/issues/66) | `read-configuration --config ` alone is rejected; gpu shape parsing can't be exercised. |
| - [ ] `up/image-metadata-merge` | [#70](https://github.com/get2knowio/deacon/issues/70) | `IMAGE_LAYER` from the image's `devcontainer.metadata` LABEL not visible in the resolved env / merged config. |
| - [ ] `up/update-remote-user-uid` | [#71](https://github.com/get2knowio/deacon/issues/71) | Container UID stays at the image's 5000 instead of syncing to the host's 1000. |
| - [ ] `run-user-commands/basic` | [#73](https://github.com/get2knowio/deacon/issues/73) | `/tmp/postStart.flag` missing after `run-user-commands` — non-blocking phases are logged "would execute" but never actually run. |
| - [ ] `set-up/basic` | [#73](https://github.com/get2knowio/deacon/issues/73) | Same as above on the `set-up` code path. |
| - [ ] `down/basic` | [#68](https://github.com/get2knowio/deacon/issues/68) | Scenario 5 (`down --all --remove` sweep of stale containers) finds none because deacon-created containers don't carry the standard `devcontainer.local_folder` label that `down --all` filters by. |
| - [ ] `features/override-install-order` | [#69](https://github.com/get2knowio/deacon/issues/69) | `./feature-X` resolved as OCI ref `registry: "."` when devcontainer.json is loaded via `--config`. |
| - [ ] `features/feature-contributed-lifecycle` | [#69](https://github.com/get2knowio/deacon/issues/69) | Same. |
| - [ ] `features/feature-env-injection` | [#69](https://github.com/get2knowio/deacon/issues/69) | Same. |
| - [ ] `features/option-sanitization` | [#69](https://github.com/get2knowio/deacon/issues/69) | Same. |
| - [ ] `features/oci-digest-pin` | [#69](https://github.com/get2knowio/deacon/issues/69) | Same; example also has a real OCI digest pin but other features in the config are local. |

## Workaround dependency (all `up`-based examples)

In addition to the per-example blockers above, **every** `up`-based example
currently requires `--mount-workspace-git-root false` to avoid silently
loading the parent repo's `.devcontainer/devcontainer.json`. Once
[#67](https://github.com/get2knowio/deacon/issues/67) lands, the workaround
becomes unnecessary and the per-example `Manual usage` invocations in each
README will work as written. The examples that already pass with the
workaround:

- `read-configuration/named-config-search`
- `up/workspace-mount`
- `up/security-options`
- `up/container-user-vs-remote-user`
- `up/override-command`
- `up/wait-for`
- `up/ports-config`
- `up/user-env-probe-modes`
- `up/initialize-command` (needs deeper investigation of one cleanup edge case, but the main scenarios pass)
- `compose/multiple-compose-files`
- `doctor/host-requirements-failure`
- `template-management/optional-paths`

## Definition of done

This issue closes when:

1. Every checkbox above is ticked (each example's `exec.sh` passes against released deacon).
2. The "Workaround dependency" section can be removed because #67 has landed.
3. `examples/README.md`'s "Known deacon issues these examples surface" section
can be deleted (or rewritten to point only at historical commits).

## Verification

Each example has an `exec.sh` driver. Run them from a clean copy outside the
deacon repo (or pre-#67, with `--mount-workspace-git-root false`):

```sh
cp -a /path/to/deacon/examples/ /tmp/run && bash /tmp/run/exec.sh
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start with the listed directories under examples/ and each example's exec.sh driver, then run the affected scripts from a clean copy outside the deacon repository. Track the linked upstream fixes and rerun each smoke test against released deacon. Done means every checkbox passes, the #67 workaround section is removable, and examples/README.md no longer needs the known-issues section.

Written by the indexing model from the issue text.