feat(devcontainer): add Mesa Dozen WSLg runtime (#41)

[zoeyrose]

Summary

Closes #41

Add a version-coherent Mesa Dozen/D3D12 Vulkan runtime to the published Linux
build image while preserving the deterministic Lavapipe/Xvfb headless path.

Implementation / behavior

• Extend the locked Linux Vulkan package contract with the loader, tools, Mesa
  Dozen ICD, and shared-library dependencies required by WSLg.
• Carry machine-readable runtime package and SPDX/provenance inventories in the
  broad Linux and slim classic-final image contracts.
• Validate the dzn ICD and loader installation without selecting an NVIDIA
  adapter in non-WSLg CI; consumers provide WSLg mounts and adapter variables
  when those host facilities are available.

Validation

• Validate the JSON/package/SBOM contracts, shell checks, and Dockerfile syntax.
• Build the Linux validation and classic-validation targets so the dzn/loader
  checks and the existing Lavapipe/Xvfb smoke remain covered.
• Run the repository tests and git diff --check; CI will build the exact image
  candidate on the final commit.

Limitations / follow-up

• Dozen device enumeration requires a WSLg consumer with /dev/dxg,
  /usr/lib/wsl, and the WSLg runtime mounts; fork-safe CI remains headless
  Lavapipe/Xvfb.
• A separate consumer change must adopt the released immutable image digest;
  this delivery changes only atrinik/devcontainer.

[github-actions]

🎉 This PR is included in version 1.9.0 🎉

The release is available on:

• v1.9.0
• GitHub release

Your semantic-release bot 📦🚀