Phase 1 toolchain: pinned dev container (prereqs not all Python)

Per operator rule: OpenTofu/age/sops/flux are Go binaries, so bake the toolchain
into a pinned Fedora-44 dev container (matches host libvirt 12) instead of a venv.
infra/devcontainer/: Containerfile + versions.env (tofu 1.9.0, age 1.2.1, sops
3.9.4, flux 2.4.0, kubectl 1.32.0, helm 3.16.0) + dev.sh (runs with host libvirt
socket + repo + ssh mounted) + README. Built & validated: all tools resolve;
virsh reaches host libvirt from inside the container.

Also record resolved Phase 1 decisions in PHASE1-SCOPE.md (6GiB/4vCPU x3;
k3s-dev NAT 10.73.0.0/24; container toolchain). Gate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/devcontainer/versions.env

@@ -0,0 +1,13 @@
+# Pinned toolchain for the home-network-k3s dev container (the reproducible baseline).
+# The non-Python prereqs (OpenTofu, age, sops, flux) are Go binaries, so — per the
+# operator's rule — they are baked into a container image instead of a venv.
+#
+# NOTE: these are best-effort pins; bump to current stable if a download 404s at build.
+FEDORA_VERSION=44
+OPENTOFU_VERSION=1.9.0
+AGE_VERSION=1.2.1
+SOPS_VERSION=3.9.4
+FLUX_VERSION=2.4.0
+KUBECTL_VERSION=1.32.0
+HELM_VERSION=3.16.0
+# terraform-libvirt provider (dmacvicar/libvirt) is pinned in the tofu module (T-1.1), not here.