feat: add CI-gated claude-dev image package

Define claude-dev capabilities as a tested contract and deploy immutable tags only after smoke checks so daily tooling upgrades remain CI-first and rollback-safe.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

claude-dev/scripts/smoke-tools.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TOOLS_FILE="${1:-/opt/claude-dev/required-tools.txt}"
+
+if [[ ! -f "$TOOLS_FILE" ]]; then
+  echo "required tools file not found: $TOOLS_FILE" >&2
+  exit 1
+fi
+
+missing=()
+while IFS= read -r tool; do
+  [[ -z "$tool" ]] && continue
+  [[ "$tool" =~ ^# ]] && continue
+  if ! command -v "$tool" >/dev/null 2>&1; then
+    missing+=("$tool")
+  fi
+done < "$TOOLS_FILE"
+
+if (( ${#missing[@]} > 0 )); then
+  echo "Missing required tools:" >&2
+  printf ' - %s\n' "${missing[@]}" >&2
+  exit 1
+fi
+
+echo "All required tools are present"