Add VS Code tunnel support for remote container access

[actflower]

Summary

This PR adds VS Code tunnel support to devs, allowing direct VS Code connections to containers without SSH. This addresses the request in #82 for avoiding the "double-hop" of SSH to host + container attach.

How it works:

• The container initiates an outbound connection to Microsoft's tunnel service
• Your local VS Code connects through that tunnel
• No SSH or port forwarding required

Changes:

• Added VS Code CLI to the devcontainer Dockerfile (supports both x64 and arm64)
• Added devs tunnel <name> CLI command with --status and --kill options
• Added tunnel management methods to ContainerManager
• Added helper scripts (start-tunnel.sh, tunnel-status.sh) for container-side operations
• Updated CLAUDE.md documentation

Usage

# Start a container
devs start mydev

# Start a tunnel (interactive, runs in foreground)
devs tunnel mydev

# First time: authenticate via device code flow
# - A URL and code will be displayed
# - Open the URL in your browser
# - Enter the code to authenticate with GitHub/Microsoft

# Check tunnel status
devs tunnel mydev --status

# Stop a running tunnel
devs tunnel mydev --kill

After the tunnel is running:

1. In VS Code, open the Remote Explorer (sidebar)
2. Look for "Tunnels" section
3. Your tunnel appears as dev-<org>-<repo>-<devname>
4. Click to connect

Test plan

• Run existing tests (pytest packages/cli/tests/ - 148 passed, 6 skipped)
• Verify devs tunnel --help shows correct usage
• Test tunnel creation with a real container
• Test VS Code connection through tunnel

Related to #82