fix(devcontainer): dev.sh defaults to prod — dev is decommissioned

Every unprefixed './dev.sh run kubectl ...' pointed at the dev cluster,
which was decommissioned on 2026-09-12. The banner cheerfully named dev and
the command then hung or errored against a context that no longer answers,
with nothing saying the cluster is gone. I hit this repeatedly tonight.

CLUSTER=dev is still accepted rather than removed, because the dev VM disks
were deliberately kept so the environment is reversible — but it now warns.

Co-Authored-By: Claude Opus 5 <[email protected]>

infra/devcontainer/dev.sh

@@ -11,13 +11,13 @@
 #   ./dev.sh build                    # build the image only
 #   ./dev.sh                          # build (if needed) + open a shell
 #   ./dev.sh run tofu -version        # run one command in the toolbox
-#   ./dev.sh run kubectl get nodes    # talks to the DEV k3s cluster directly (no tunnel)
+#   ./dev.sh run kubectl get nodes    # talks to the PROD k3s cluster directly (no tunnel)
 #
-# CHOOSING A CLUSTER — `CLUSTER=<dev|prod>`, defaulting to dev:
+# CHOOSING A CLUSTER — `CLUSTER=<prod|dev>`, defaulting to PROD (dev was decommissioned):
 #
-#   ./dev.sh run kubectl get nodes                 # dev  (the default; unchanged behaviour)
-#   CLUSTER=prod ./dev.sh run kubectl get nodes    # prod
-#   CLUSTER=prod ./dev.sh                          # interactive shell pointed at prod
+#   ./dev.sh run kubectl get nodes                 # prod (the default since 2026-09-12)
+#   CLUSTER=dev ./dev.sh run kubectl get nodes     # dev — DECOMMISSIONED, warns; VMs are down
+#   ./dev.sh                                       # interactive shell pointed at prod
 #
 # The selector is an env-var PREFIX so the target is visible on the same line as the command, and
 # every invocation prints a banner naming the cluster it is about to talk to. Inside the container
@@ -56,9 +56,17 @@ source "${HERE}/versions.env"
 # Prod is reached the same way via infra/ansible/.cache/prod.kubeconfig (https://192.168.2.9:6443).
 
 # ------------------------------------------------------------------ cluster selection
-CLUSTER="${CLUSTER:-dev}"
+# Defaults to PROD because dev was decommissioned on 2026-09-12 (full migration: dev out, prod
+# onto the apex — see DECISIONS-LOG). Defaulting to a cluster that no longer answers made every
+# unprefixed `./dev.sh run kubectl ...` a silent no-op against a dead context, which is a trap:
+# the banner named dev, the command hung or errored, and nothing said "that cluster is gone".
+# `CLUSTER=dev` is still ACCEPTED, not removed — the dev VM disks were deliberately kept so the
+# environment is reversible — but it warns, because a working dev cluster is no longer the default
+# assumption anywhere in this repo.
+CLUSTER="${CLUSTER:-prod}"
 case "${CLUSTER}" in
-  dev|prod) ;;
+  prod) ;;
+  dev)  printf '\033[33mWARNING: CLUSTER=dev — dev was DECOMMISSIONED 2026-09-12; this context will not\nanswer unless the dev VMs have been deliberately brought back up.\033[0m\n' >&2 ;;
   *) printf '\033[31mERROR: CLUSTER=%s is not a known cluster (dev|prod).\033[0m\n' "${CLUSTER}" >&2; exit 2 ;;
 esac
 CLUSTER_KUBECONFIG="${REPO_ROOT}/infra/ansible/.cache/${CLUSTER}.kubeconfig"