ci: Use devcontainer for CI to match local development

Replace separate toolchain installation with devcontainers/ci action
that runs inside the same devcontainer image used for local development.
This ensures CI and local builds use identical environments.

Both jobs now delegate to Justfile targets:
- ci job: runs `just ci` (fmt check, clippy, tests)
- kani job: runs `just kani` (formal verification proofs)

Also updates .devcontainer.json to use bootc-dev/devenv-debian image
which includes Kani, cargo-nextest, and other development tools.

Assisted-by: OpenCode (Claude Sonnet 4)

Author: cgwalters

.devcontainer.json

@@ -1 +1,3 @@
-{"image":"mcr.microsoft.com/devcontainers/rust:latest"}
+{
+  "image": "ghcr.io/bootc-dev/devenv-debian:latest"
+}

.github/workflows/build.yml

@@ -1,43 +1,42 @@
-name: Rust
+name: CI
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
+
 permissions:
   contents: read
 
-# don't waste job slots on superseded code
+# Don't waste job slots on superseded code
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  CARGO_TERM_COLOR: always
-
 jobs:
-  tests-stable:
-    name: Tests, stable toolchain
+  ci:
+    name: CI
     runs-on: ubuntu-latest
     steps:
-      - name: Check out repository
+      - name: Checkout
         uses: actions/checkout@v4
-      - name: Install toolchain
-        uses: dtolnay/rust-toolchain@v1
+
+      - name: Build and run CI in devcontainer
+        uses: devcontainers/ci@v0.3
         with:
-          toolchain: stable
-      - name: Cache build artifacts
-        uses: Swatinem/rust-cache@v2
-      - name: cargo build
-        run: cargo build --all-targets
-      - name: cargo test
-        run: cargo test --all-targets
+          push: never
+          runCmd: just ci
 
   kani:
     name: Kani formal verification
     runs-on: ubuntu-latest
     steps:
-      - name: Check out repository
+      - name: Checkout
         uses: actions/checkout@v4
-      - name: Run Kani proofs
-        uses: model-checking/kani-github-action@v1
+
+      - name: Run Kani proofs in devcontainer
+        uses: devcontainers/ci@v0.3
+        with:
+          push: never
+          runCmd: just kani