⚡️ Drop the compiler, persist Claude Code, pull upstream fixes

[elcajon]

Proposed Changes

Dropping the compiler

build-essential and python3-dev were installed and purged again inside the
same layer, so they existed purely to compile Python packages during
pip install. Both are gone; their absence is the guard, since a dependency
that needs compiling now fails the build loudly.

Measured, cold cache both times:

	with compiler	without
Build amd64 (native, low noise)	3:40	2:43	−22%
Build aarch64 (QEMU)	9:54	9:29	within noise

Only the amd64 number is worth trusting: repeated aarch64 runs of the same tree
came in at 9:29 and 11:14, so QEMU throughput varies by more than this change
moves the needle there.

One behavioural change worth knowing: crcmod, esptool and paho-mqtt have
no aarch64 wheels and are built from sdists — that was already true before this
PR. They build fine without a compiler because the builds are pure Python, but
crcmod no longer builds its optional C accelerator (_crcfunext) and falls
back to the Python implementation. That affects checksum speed when flashing via
esptool, nothing else.

Claude Code configuration is persisted

Claude Code is not shipped in the image; users install the
Anthropic.claude-code extension from the Extensions view, which is published
on Open VSX and carries its own claude binary.

What this app adds is persistence, following upstream
(hassio-addons/app-vscode#1129): the service exports
CLAUDE_CONFIG_DIR=/data/claude, and the user init creates that folder and
migrates a login left behind in ~/.claude or ~/.claude.json, so logins and
settings survive restarts and updates. DOCS.md explains the installation, why
signing in has to happen from a terminal behind ingress, and where the bundled
binary sits for anyone who wants it on PATH.

Version constraints

wget and git-crypt lost their lower bounds in #1238: unquoted,
wget>=1.25.0-2 is a shell redirection; quoted, apt-get install splits at the
= and looks for a package called wget>. apt-get satisfy does take
relational constraints, so they now read

&& apt-get satisfy -y --no-install-recommends \
    "git-crypt (>= 0.7.0-0.1+b1)" \
    "wget (>= 1.25.0-2)" \

which is what #1224 wanted — git-crypt carries a different binNMU revision per
architecture (+b1 on amd64, +b2 on arm64), so an exact pin cannot cover both.
A second Renovate manager matches the "pkg (>= version)" spelling; verified
against the Dockerfile, 23 exact pins on the existing manager and 2 constraints
on the new one.

Fixes pulled from upstream app-vscode

• The find cleanup bound its -exec to the last -o branch only, so only
  *.pyo files were ever removed — never the test, tests and __pycache__
  directories it lists.
• 01-vs-mysql created /root/.config but writes the client config to
  /etc/mysql/conf.d/service.cnf, a directory it never created.
• 01-vs-user linked ~/.ssh with ln -sn; when ~/.ssh exists as a real
  directory the link lands inside it as ~/.ssh/.ssh. It now clears that case,
  cleans up the nested link and uses ln -sfn (Fix SSH key symlink creating nested .ssh directory hassio-addons/app-vscode#1098).
• 01-vs-mosquitto linked with plain ln -s, which fails on a re-run and
  reported nothing. Now ln -sf with a warning.
• code-server/finish treated a stop by signal as a crash and never propagated
  an exit code to the container. It now reports the code, halts on SIGTERM and
  lets s6 restart only on a real crash.
• code wrapper so files open in the running editor from a terminal, ha gets
  its zsh completion registered, and the esphome file association matches
  nested folders.

Deliberately not pulled, as discussed: the config_path option and /config as
the workspace, hassio_role: manager, the packages / init_commands options
(this app has custom services instead), the user-bundles.d layout,
python3-venv and /etc/motd (ha banner covers it).

Verification

hadolint 2.5.0, 2.8.0 and 2.14.0 clean; shellcheck clean on every changed
script, with no new findings; settings.json valid; the Renovate regexes run
against the Dockerfile; doc link references resolved both ways and added lines
within the 80-column limit. Both architectures built green on the previous two
heads.

Related Issues

Follow-up to #1238; restores the constraint intent from #1224.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pwumst3pLFGsbbzLSxYQMv