Migrate host devcontainer tooling from @devcontainers/cli to deacon

## Summary

Migrate remo's host-side devcontainer tooling from the reference Node.js CLI (`@devcontainers/cli`) to [`deacon`](https://github.com/get2knowio/deacon) — our own Rust implementation of the DevContainer CLI.

## Motivation

- **Drops the Node.js/npm dependency** on every provisioned host purely to run `devcontainer up`/`exec`. `deacon` ships as a single static binary (curl-installed), removing the `nodejs` → `npm -g @devcontainers/cli` chain from the provisioning path.
- **Faster, focused**: deacon is "the DevContainer CLI, minus the parts you don't use" — we only use the developer-facing `up`/`exec` surface, not feature authoring, which is exactly deacon's target.
- **First-party**: same org (`get2knowio`), so we control the roadmap and can file parity gaps upstream.

## Current usage inventory

**Install (to be replaced):**
- `ansible/roles/devcontainers/tasks/main.yml` — `npm install -g @devcontainers/cli`
- Listed in npm-global package lists: `ansible/{aws,incus,hetzner,proxmox}_site.yml`, `ansible/{aws,incus,hetzner}_configure.yml`
- `ansible/README.md` (role table + dependency list)

**Invocations (`devcontainer up` / `devcontainer exec`):**
- `ansible/roles/user_setup/templates/project-launch.sh.j2:99,101`
- `ansible/roles/user_setup/templates/devshell.sh.j2:87,92,95,96`
- `ansible/roles/user_setup/tasks/main.yml:319,347` (devcontainer auto-start block, incl. `$_rebuild_flag`)

All invocations use the `--workspace-folder` form.

## Scope / tasks

- [ ] Add a `deacon` install path to the `devcontainers` role (curl install script, pinned version) — replace the npm global install.
- [ ] Drop `@devcontainers/cli` from the npm-global package lists in the 7 site/configure playbooks (and re-evaluate whether `nodejs`/`npm` are still needed on the host for anything else).
- [ ] Swap `devcontainer up`/`devcontainer exec` → `deacon up`/`deacon exec` in the three `user_setup` files above.
- [ ] Verify flag parity for the rebuild path (`$_rebuild_flag` → deacon equivalent of `--remove-existing-container` / `--build-no-cache`).
- [ ] Update `ansible/README.md` (role description + dependency list).
- [ ] Re-test the full flow on a fresh host AND a host with existing state (Constitution: idempotency) for each provider: project auto-start in zellij, `remo shell -p `, and `--exec`.

## Open questions / parity to confirm

- Does deacon's `up`/`exec` accept the same `--workspace-folder` semantics and exit codes the launch scripts rely on?
- Rebuild flag mapping for the config-hash-changed rebuild branch in `user_setup/tasks/main.yml`.
- Version pinning + install method on hosts (curl `install.sh`; deacon is currently pre-release `v0.2.0` — may want `--prerelease` or a pinned release asset until GA).

## Out of scope

- The `features/remo-notifier-source/` devcontainer Feature (deacon targets consumers, not feature authoring; this Feature is consumed by whatever CLI builds the container, not invoked by remo directly).
- Any change to `remo` CLI command surface — this is host-provisioning internal.

Start with ansible/roles/devcontainers/tasks/main.yml, the seven provider playbooks, and the three user_setup files named in the inventory. Check deacon's up/exec flag and exit-code behavior before changing the install and invocations. Done means the README and package lists are updated, rebuild behavior is preserved, and fresh and existing hosts pass the listed project launch, shell, and exec flows for each provider.

Written by the indexing model from the issue text.