feat(deploy): add SSH access to agent dev containers

[simonjcarr]

Summary

• install and enable OpenSSH server in the agent dev container image
• publish container port 22 on a random loopback host port
• create a default ssh-user/password login and print the SSH command
• document the SSH mapping and login defaults

Validation

• bash -n deploy/scripts/create-agent-dev-container.sh deploy/scripts/test-create-agent-dev-container.sh
• bash deploy/scripts/test-create-agent-dev-container.sh
• live Docker smoke test confirmed ssh-user exists, password is set, password auth is enabled, and ssh.service is active

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0aae4a562

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Normalize IPv6 SSH bind addresses before publish

Using --ssh-bind-address with an IPv6 literal (for example ::1) currently produces --publish ::1::22, which Docker parses incorrectly because IPv6 host IPs must be bracketed in publish mappings (e.g. [::1]:...). This makes container startup fail for IPv6 bind-address use cases even though the flag is documented as accepting an IP address. Consider normalizing IPv6 values (or requiring bracketed input) before composing the --publish argument.

Useful? React with 👍 / 👎.