devcontainer: set KUBECONFIG + persist SOPS age key to host

Two dev.sh gaps surfaced while running bootstrap/sops/install-age-key.sh:
- kubectl defaulted to localhost:8080 (connection refused) because KUBECONFIG
  was never set in the toolbox. Set KUBECONFIG=/work/infra/ansible/.cache/dev.kubeconfig
  (override via DEV_KUBECONFIG); --network host already reaches 10.73.0.11:6443.
- age-keygen.sh writes the PRIVATE key to ~/.config/sops/age/keys.txt, but that
  path was not mounted in the --rm container, so the key was lost on exit. Mount
  ${HOME}/.config/sops -> /root/.config/sops (created first) so the key persists
  on the host and SOPS_AGE_KEY_FILE resolves to it.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.sops.yaml

@@ -28,9 +28,9 @@ creation_rules:
     encrypted_regex: "^(data|stringData)$"
     # >>> REPLACE-ME <<< paste the age PUBLIC recipient printed by age-keygen.sh.
     # Example shape (NOT a real key): age1qy...placeholder...0abcd
-    age: "REPLACE-ME-AGE-PUBLIC-RECIPIENT"
+    age: "age1u70g00m38pt4zte00n4fsqfyj3rf8725xn4w7e6lx80evt4rcalsdnprp8"
 
   - path_regex: (^|/)secrets/.*\.ya?ml$
     encrypted_regex: "^(data|stringData)$"
     # >>> REPLACE-ME <<< same age PUBLIC recipient as above.
-    age: "REPLACE-ME-AGE-PUBLIC-RECIPIENT"
+    age: "age1u70g00m38pt4zte00n4fsqfyj3rf8725xn4w7e6lx80evt4rcalsdnprp8"