feat(code-server): Dockerfile + CI for ghcr.io/nprodromou/code-server (WOVED-35)

[claude-prodromou]

Summary

• Adds Dockerfile.code-server — thin overlay on codercom/code-server that installs gh (GitHub CLI), tmux, Node.js 22 on the system PATH, and the @openai/codex + @anthropic-ai/claude-code agent CLIs
• Adds .github/workflows/build-code-server.yml — CI that pushes to ghcr.io/nprodromou/code-server (:latest on main, sha-<short> on every push)
• Hosted in this repo (nprodromou/codex-shell) since claude-prodromou cannot create repos in nprodromou/; the workflow explicitly targets the nprodromou/code-server GHCR package

Relation to apk8s

Deploys to apk8s via PR #165 (ops-code-server branch) which contains the full HelmRelease, ExternalSecret, PVC, ConfigMap, and CF tunnel entry. That PR's helmrelease currently pins :latest — once the first CI build on this PR lands, bump to the sha-<short> tag in apk8s PR #165.

Operator TODOs (before PR #165 can merge)

1. 1Password: create item agents-code-server in the Kubernetes vault with fields:
   • pat — GitHub PAT (repo + workflow scopes); nprodromou credentials are the right choice for a personal IDE
   • git_user_name — e.g. Nate Prodromou
   • git_user_email — e.g. nate@prodromou.com
2. Pin image tag in apk8s PR #165 once the first CI build produces a sha-<short> tag here
3. Cloudflare Access policy — verify code-server.prodromou.com is covered by the WARP enrollment policy (should already be true via the wildcard, but confirm)

Test plan

• CI build passes, image pushed to ghcr.io/nprodromou/code-server:latest and sha-<short>
• gh --version, codex --version, claude --version work inside the container
• After apk8s PR #165 merges and Flux reconciles: code-server.prodromou.com opens VS Code in the browser from a WARP-enrolled device
• Integrated terminal can git commit and gh pr create attributed to the identity in the mounted secret

🤖 Generated with Claude Code

[claude-prodromou]

Superseded by #28 (code-server-WOVED-35 branch). Closing stale PR.