feat: add nub feature + fix release CI + peon-ping bugs + roadmap cleanup

[baxyz]

Description

Started as a single CI permissions fix, grew to cover everything requested in the same pass:

Release CI fix (the original trigger — release.yml just failed):

• Added workflows: write to the release job — git push of a tag whose ref touches a workflow file needs it, confirmed from the actual failed run's logs (run 31324555689). GHCR publish itself had already succeeded before this step failed; only tags + website dispatch were lost. Needs a manual remediation pass after merge (create the 2 missing tags, force a re-run).

New feature: nub

• src/nub/ — installs nub per the migration strategy from ROADMAP.md: dependsOn the official node feature (never nub's own node-version management), installGlobally option mirroring vite-plus.
• Verified for real, not just written: downloaded and ran the actual installer against latest and a pinned version, ran nub --version, ran a JS file through nub, confirmed the nubx symlink dispatches correctly.

package-auto-install + nub integration

• packageManager gained a nub value (runs nub install), deliberately excluded from auto detection since nub isn't a lockfile format.

peon-ping fixes (2 real bugs, not 1)

• install.sh's Copilot hooks merge path had a genuine Python SyntaxError (a dict literal missing its assignment) — confirmed with python3 -m py_compile before/after, plus a functional test.
• README claimed no port-forwarding config was needed for host.docker.internal:19998 — wrong on native Linux Docker, verified empirically from inside a real devcontainer here (getent hosts host.docker.internal resolves nothing without runArgs: ["--add-host=host.docker.internal:host-gateway"], which a Feature can't add itself).
• Re-evaluated the "simplify pack selection" roadmap idea — concluded no schema change was warranted (packs was already simple), added pack-discovery docs instead.

python-dev — evaluated, not built

• Checked the official ghcr.io/devcontainers/features/python:1 manifest directly: it already bundles VS Code extensions + settings on top of the interpreter, unlike angular-cli. No gap left to fill, no repo in the org uses Python yet. Documented the reasoning in ROADMAP.md instead of building something redundant.

ROADMAP.md updated throughout to match.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring
• Test improvement

Related Issues

None.

How Has This Been Tested?

• jq empty / bash -n / bootstrap-canonical checks on every touched/new manifest and script
• js-yaml parse on both touched workflow files
• nub: real end-to-end install + run test (network access available in this environment)
• peon-ping: python3 -m py_compile + functional merge test on the fixed hooks script
• peon-ping: host.docker.internal DNS gap reproduced empirically from inside a real devcontainer

Checklist

• My code follows the code style of this project
• I have updated the documentation accordingly
• I have added tests for my changes (nub has a test/nub/test.sh; peon-ping/package-auto-install fixes are to existing scripts, covered by manual verification above)
• All new and existing tests passed locally
• My commits follow the conventional commit format

Screenshots (if applicable)

N/A.

Additional Context

After merge: remediate the failed release (2 missing git tags, force a re-run for the website dispatch).

🤖 Generated with Claude Code

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🧾 Conventional Commits	passing
✅	🔖 Version Bump	passing
✅	🧪 Feature Tests	passing
✅	🐚 ShellCheck	passing

---

_{🤖 Generated by @helpers4 CI • 2026-08-09}