Move the login volumes to the shared feature, and add gh's

[AndreasBur]

Rebased onto master now that #76 is in. That one persisted the Codex login by declaring its
volume in each committed variant; two things were left over.

gh has the same problem, for the same reason

gh's configuration lives in the container's home, so every rebuild costs a fresh
gh auth login — and unlike the Codex one, that is noticed a push later rather than at the
rebuild itself. It gets the same treatment: a wordclock-gh volume at /home/vscode/.config/gh.

The volume was declared twice

linux/ and wslg/ each carried the mount, which is one place too many for something both
variants want. It belongs where ~/.platformio already is — the shared feature, which
every variant loads:

{ "source": "wordclock-codex", "target": "/home/vscode/.codex",     "type": "volume" },
{ "source": "wordclock-gh",    "target": "/home/vscode/.config/gh", "type": "volume" }

So the two per-variant declarations come out again. Leaving them in would put two mounts on
one target, which fails container creation rather than being ignored — that is the part of
this rebase that is not cosmetic, and wslg/ needed it as much as linux/ did.

That move also fixes a variant nobody had looked at: WSLg had the same gap, and the same
line closes it.

The Dockerfile and the README

~/.config/gh is seeded beside ~/.codex, both at 0700 — an empty named volume takes its
ownership from the path it covers, and gh refuses to read a config directory that others
can enter. 0755 would be the cache's mode, and a credential is not a cache.

The two README passages became one. #76 put its section high up, where somebody looking for
it will find it, and that is where it stays — carrying both volumes now, why they are in the
feature, and the seeding. Further down, the sentence #76 struck out is replaced rather than
left as a gap: what must stay out of a committed variant is a secret or an internal address,
and a mount line is neither. It names a volume that exists only on the machine that created
it, and nothing about it reaches the repository.

One thing outside this diff

The untracked vector/devcontainer.json declared both volumes itself and had to give them up,
for the duplicate-mount reason above. It is gitignored, so it is not here; it was edited
locally and its comment records why. Its chown stays — volumes created before this kept
the ownership they were created with, and an image cannot reach back into an existing volume.

Verification, and its limit

Checked: the feature JSON parses, and no variant collides with the feature on a mount target
(all three checked against the feature's list programmatically, which is how the leftover
wslg line was caught).

Not checked by a build — there is no Docker daemon inside the dev container. The real test
is two rebuilds of the Linux variant: the first creates the volumes, and only the second can
show that a login survived. Worth doing before merging, since that is exactly what this claims
to fix.