fix(devcontainer): support canonical uv locks with custom package indexes

Devcontainer creation fails when `UV_DEFAULT_INDEX` points to an internal mirror while committed `uv.lock` files retain canonical public source metadata. `uv sync --locked` treats the custom default index as a changed lock input and exits before dependencies are installed. The same mismatch prevents `npm run test:py` from reaching project tests inside the resulting container.

The fix should preserve canonical public lockfiles, validate their exact versions and hashes, and install through the configured mirror without relocking. Project-declared indexes must remain available for packages hosted outside the default index.

## Acceptance Criteria

- [ ] Devcontainer setup succeeds with the canonical public default index.
- [ ] Devcontainer setup succeeds with a custom `UV_DEFAULT_INDEX` without changing committed lockfiles.
- [ ] Mirrored installs enforce versions and artifact hashes from each committed `uv.lock`.
- [ ] Project-declared indexes remain available after the configured mirror.
- [ ] `npm run test:py` can run locked project tests when a custom default index is active.
- [ ] Automated tests cover public-index, custom-index, child failure, and missing-lock behavior.
- [ ] Enterprise mirror and validation documentation explains the restore behavior and lockfile constraints.

Start with the devcontainer creation flow and the handling of committed uv.lock files, then run npm run test:py with both the public index and a custom UV_DEFAULT_INDEX. Verify that locked versions and hashes remain unchanged, project-declared indexes still work, child failures and missing locks are covered, and the enterprise mirror and validation documentation explains the constraints.

Written by the indexing model from the issue text.