chore: manage development services with Compose

[kylos101]

Summary

Manage the scanner and findings service through the Docker Compose engine inside the existing Universal Dev Container, without adding a Dev Container Feature.

Changes

• Add the findings service to the root Compose project and require host networking for both application services.
• Build both application images from the install task.
• Add a manual and post-start findings task that depends on install and starts findings through Compose.
• Ignore the generated .pnpm-store/.

Testing

# Validate the Dev Container and Ona automation configuration.
gitpod environment devcontainer validate .devcontainer/devcontainer.json
gitpod environment config validate .ona/automations.yml

# Stop all Compose containers and remove both service images.
docker compose --profile scan down --rmi all

# Build both service images.
docker compose build codex-security findings

# Start Compose and manually verify its default services.
docker compose up

# Press Ctrl+C, then stop Compose and all services.
docker compose down

Risk and rollout

The findings service claims host port 3000 when the Dev Container starts. Scanner execution remains manual and retains its existing user, seccomp, capability, credential, and filesystem protections. Removing volumes permanently deletes local findings data. No public CLI surface changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.