Package agentsh as a devcontainer Feature (injectable install + launch)

## Summary

Package **agentsh** as a devcontainer Feature (install + launch) so it can be injected into devcontainers via the CLI overlay (`--additional-features`). Today only the *connector* (`features/remo-notifier-source/`) is a Feature; it assumes agentsh is already present and running. To make the approval gate host-enforced (#42), agentsh itself must be injectable.

Sub-issue of #42 (host-enforced agentsh injection). Interlocks with #41 (deacon migration — the overlay seam lives in the launch scripts).

## Why

- The current `remo-notifier-source` Feature only registers an *existing* agentsh's URL+key with the notifier — it does not install or run agentsh.
- For #42's host-overlay model ("configure the host → every container gets the gate"), the overlay must inject **both** agentsh and the connector. agentsh-as-a-Feature is the missing half.

## Scope

- [ ] New Feature `features/agentsh/` — `devcontainer-feature.json`, `install.sh`, launch hook.
- [ ] Install agentsh (upstream: `canyonroad/agentsh`) — pin a version; idempotent install.
- [ ] Launch agentsh as a long-lived process exposing its approvals REST API on a **conventional port** (so the connector can derive `api_url` by convention — see #42).
- [ ] Write the approver key to a **conventional file path** the connector reads (see #42).
- [ ] Options: agentsh version, port, key path (all with convention defaults).
- [ ] Compose cleanly with `remo-notifier-source` when both are injected via `--additional-features` (ordering / `installsAfter`).
- [ ] README + smoke test (mirror `features/remo-notifier-source/` test style).

## Open questions
- agentsh install method / artifact (binary release vs build) and version pinning.
- Conventional port + key path values (must match what #42's connector assumes).
- How agentsh is configured to gate the in-container workload (entrypoint wrapping vs sidecar process) — may be agentsh-upstream-dependent.
- Lifecycle behavior when injected via `--additional-features` vs declared in config (verify under deacon, per #41).

## Links
- Parent: #42
- Related: #41

Start by reading features/remo-notifier-source/ and its smoke test to understand the existing Feature pattern. Then review #42 and #41, especially the overlay and launch-script seams, to resolve the install method, port, key path, lifecycle, and composition questions. Done means a new features/agentsh/ Feature installs and launches agentsh, composes with the connector, and has README and smoke-test coverage.

Written by the indexing model from the issue text.