feat: add CI-gated claude-dev image package

Define claude-dev capabilities as a tested contract and deploy immutable tags only after smoke checks so daily tooling upgrades remain CI-first and rollback-safe.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

claude-dev/Dockerfile

@@ -0,0 +1,60 @@
+FROM node:20-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+      bash \
+      ca-certificates \
+      curl \
+      fd-find \
+      gh \
+      git \
+      jq \
+      make \
+      openssh-client \
+      python3 \
+      ripgrep \
+      rsync \
+      unzip \
+      wget \
+      zip \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN ln -sf /usr/bin/fdfind /usr/local/bin/fd
+
+ARG YQ_VERSION=v4.44.6
+RUN wget -q -O /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \
+    && chmod +x /usr/local/bin/yq
+
+RUN npm install -g @anthropic-ai/claude-code
+
+RUN python3 - <<'PY'
+from pathlib import Path
+
+path = Path("/usr/local/lib/node_modules/@anthropic-ai/claude-code/cli.js")
+if not path.exists():
+    raise SystemExit(f"claude cli not found: {path}")
+
+content = path.read_text()
+old = 'F8.get("https://api.anthropic.com/api/hello",{headers:K8($)}).catch((()=>!1))'
+if old not in content:
+    raise SystemExit("preflight patch target not found in claude cli; refusing to build")
+
+patched = content.replace(old, "!0")
+path.write_text(patched)
+
+if old in path.read_text():
+    raise SystemExit("preflight patch did not apply cleanly")
+
+print("Applied Claude preflight bypass patch")
+PY
+
+WORKDIR /repos/nas-tools
+
+COPY required-tools.txt /opt/claude-dev/required-tools.txt
+COPY scripts /opt/claude-dev/scripts
+
+RUN chmod +x /opt/claude-dev/scripts/*.sh
+
+CMD ["bash"]