Scaffold Devcontainers.app — Tauri 2 conversion (steps 1–4)

[Copilot]

Foundation for converting devcontainers-cli (Node TS CLI) into Devcontainers.app, a Tauri 2 macOS app driving Apple Containers as the v1 backend, with seams for Podman and Docker. Node is removed from the runtime; the surviving devcontainer-spec TS slice is bundled by Deno and runs in the WebView, while all I/O moves to Rust behind a ContainerRuntime trait. The legacy CLI under src/ is left intact in this PR and will be removed in a follow-up (step 9 of ROADMAP.md).

Spec slice carve-out (spec/)

• Mirrors the upstream layout (spec-configuration/, spec-common/, spec-utils/) for cheap periodic merges.
• pfs.ts reduced to the FileHost interface only — no ncp, no containerFeaturesConfiguration/tar edges.
• spec-utils/workspaces.ts no longer imports a runtime path module; uses a string-suffix check so the FileHost.path seam is the single source of truth.
• Type-checks under both tsc -p spec/tsconfig.json and deno check.

Deno build pipeline

• deno.json with import map (vscode-uri, jsonc-parser, esbuild, esbuild-plugin-polyfill-node, @tauri-apps/api) and unstable: ["sloppy-imports"] so extensionless imports work for both toolchains.
• scripts/build-engine.ts emits a single dist/devcontainer-engine.js ESM bundle (esbuild + curated polyfills for path/crypto/url).
• scripts/check-no-node-builtins.ts is a deny-list (fs, child_process, tar, ncp, node-pty, proxy-agent, …) run in CI; the build fails if any sneak into the bundle.

Tauri 2 app shell (src-tauri/)

• lib.rs/main.rs, Cargo.toml, tauri.conf.json, build.rs. beforeBuildCommand chains deno task build and the Vite frontend build.
• CSP: default-src 'self'; img-src 'self' data: blob:; style-src 'self'; script-src 'self'. No remote content, no 'unsafe-inline'.
• Module layout matches the plan:
  • host/{config,permissions,window_state,menu}.rs — ported in shape from wiki3-ai/wiki3-app. HostState persists to <app-data>/state.json.
  • commands/{workspace,runtime,lifecycle,fs}.rs — Tauri command surface.
  • container/{traits,apple_containers,podman,docker}.rs — ContainerRuntime trait + RuntimeRegistry; apple_containers probes the container CLI, podman/docker return Unsupported.
  • devcontainer/{translate,lifecycle}.rs — ContainerSpec translation with image-ref parsing tests, lifecycle hook enum.
  • pty/ — placeholder for portable-pty integration.
• FileHost bridge (commands/fs.rs) canonicalises every requested path against a registered workspace root and rejects anything outside it; writes are gated separately.

Frontend (frontend/)

• Vite + TS scaffold, lib/bridge.ts typed wrapper around invoke()/listen().
• devcontainer-engine/index.ts composes a FileHost whose methods proxy to fs_* Tauri commands — the seam by which the bundled spec slice will parse real devcontainer.json files end-to-end (wired in step 6).

CI, docs, attribution

• .github/workflows/devcontainers-app.yml: cargo fmt --check / check / clippy -D warnings / test, deno task check / build / build:check-no-node-builtins, and tsc -p spec/tsconfig.json --noEmit.
• ROADMAP.md tracks steps 5–11 (Apple Containers impl, FileHost wiring, lifecycle orchestrator, MVP UI, legacy removal, Features/templates/compose, Podman/Docker).
• NOTICE.md records the MIT/Microsoft attribution for the surviving slice.

Follow-ups

Steps 5–11 land in subsequent PRs; the legacy Node CLI, esbuild.js, azure-pipelines.yml, and the node-pty/proxy-agent/yargs/chalk dependency surface are removed in step 9 once the Rust runtime path is functional.