Include ripgrep in the Codespaces image

[rmcdaniel]

Summary

• install ripgrep in the prebuilt development image
• require rg in image qualification
• cover the package and executable contract in the devcontainer test

Verification

• focused devcontainer image contract: 131 assertions passed
• candidate image workflow will build and run the in-image qualification before merge

[rmcdaniel]

The candidate image qualification passed natively on both amd64 and arm64, and the PHP/Python/Rust smoke passed cold and warm.

The service-mode onboarding failure is independent of this image change: Waterline returns 500 because waterline_saved_views and waterline_user_preferences have not been migrated. That defect is already tracked in #60 and reproduces on the unchanged service-mode path.