feat: add CI-gated claude-dev image package

Define claude-dev capabilities as a tested contract and deploy immutable tags only after smoke checks so daily tooling upgrades remain CI-first and rollback-safe.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

claude-dev/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  claude-dev:
+    image: claude-dev:${CLAUDE_DEV_IMAGE_TAG:?CLAUDE_DEV_IMAGE_TAG is required}
+    container_name: claude-dev
+    restart: unless-stopped
+    network_mode: host
+    stdin_open: true
+    tty: true
+    working_dir: /repos/nas-tools
+    volumes:
+      - /volume1/repos:/repos
+      - /volume1/docker/claude-dev/claude-config:/root/.claude
+      - /volume1/docker/claude-dev/claude-config/.claude.json:/root/.claude.json
+      - /volume1/docker/claude-dev/gitea_token:/root/.gitea_token:ro
+      - /volume1/docker/claude-dev/bashrc:/root/.bashrc