Dev container: fix the build, start Claude at max effort, seed gh, and keep history and caches across rebuilds

Problem

The dev container already keeps the gh, Claude Code and Codex config directories on volumes, but:

The dev container doesn't build, on main either. "image": "mcr.microsoft.com/devcontainers/base:ubuntu" floats, and the tag now resolves to Ubuntu 26.04 "resolute", where the docker-in-docker Feature refuses its default moby option, so the build stops in that Feature, before any lifecycle script runs.
Claude Code starts at its default effort. Max can't be the default from the settings file, whose effortLevel accepts only low to xhigh; only CLAUDE_CODE_EFFORT_LEVEL can.
Claude Code's .claude.json is lost on every rebuild. It holds the account, onboarding and trust state. Without CLAUDE_CONFIG_DIR it lands in ~/, outside the claude-config volume.
A rebuild loses shell and REPL history, and every cache. containerEnv points uv, pip, npm, bun, Go, Deno, ruff and mypy at ~/.cache, but nothing keeps that directory, so post-create's uv sync downloads every wheel again.
gh is never logged in for you. The gh-config volume keeps a login, but nothing ever creates one. git's github.com credential depends on what the host's .gitconfig brings, which can name the host's own gh binary (!/opt/homebrew/bin/gh auth git-credential), a path that doesn't exist in the container.
The ShellCheck job skips a script. It scans .devcontainer/scripts, but zsh also sources .devcontainer/config/shell/aliases.shared.sh.
The Claude Code VS Code extension isn't installed.

The dev container builds again, in CI's Devcontainer Build job too: the base image is pinned to base:ubuntu-24.04, the template's image.
Every Claude Code session starts at max effort; CLAUDE_CODE_EFFORT_LEVEL=auto claude opts out.
.claude.json survives a rebuild, inside the claude-config volume.
A rebuild keeps shell and REPL history and the caches, each on a musher-${devcontainerId}-<purpose> volume owned by vscode.
gh is seeded from the host and git pushes through it. Nothing writes ~/.gitconfig before VS Code copies the host's.
The ShellCheck job scans every shell file under .devcontainer, and runs when one of them changes.

Part of rolling one dev-container baseline out to every musher-dev repository that has a dev container (musher-dev/development-container#56).