devcontainer-lock.json: feature lockfile not produced or honored #26

Gap

The spec defines `devcontainer-lock.json` for reproducible feature resolution: each feature's resolved digest is recorded so subsequent runs pin to the same content. We have content-addressed caching (`feature/disk_store.go`) but no lockfile write/read.

Expected

• On `Up`, after feature resolution, write `/devcontainer-lock.json` with each feature's `ref` → `resolvedRef` (digest).
• On subsequent `Up`, prefer the lockfile entry over re-resolving the mutable tag.
• Refresh policy: opt-in flag (e.g. `UpOptions.RefreshFeatures`) re-resolves and overwrites.

Notes

Lower priority for DAP (it pins via pre-baked images), but expected by general spec consumers and the upstream CLI ecosystem.