fix(devcontainer): only init missing submodules on container start

git submodule update --init runs on every postCreate, which on
container rebuild moves any submodule whose HEAD differs from the
parent's pinned SHA into detached HEAD — silently yanking
in-progress branch work in initialized submodules. The data isn't
lost (reachable via reflog and existing branches) but recovery
requires submodule literacy that not every user has.

Filter to only the uninitialized submodules using git submodule
status output (leading '-'), preserving the first-clone build
protection without touching already-checked-out submodules. Applies
to all generated projects, not just the Claude-sandbox case.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: gilesknap

.devcontainer/postCreate.sh

@@ -6,5 +6,10 @@ uv venv --clear
 uv sync
 pre-commit install --install-hooks
 
-# Initialise git submodules if any are declared
-[ -f .gitmodules ] && git submodule update --init || true
+# Init only submodules that aren't checked out yet — first-clone
+# protection without touching already-initialized submodules (which
+# would yank in-progress branch work to detached HEAD on rebuild).
+if [ -f .gitmodules ]; then
+    missing=$(git submodule status | awk '/^-/ {print $2}')
+    [ -n "$missing" ] && git submodule update --init $missing
+fi

template/.devcontainer/postCreate.sh.jinja

@@ -9,5 +9,10 @@ uv venv --clear
 uv sync
 pre-commit install --install-hooks
 
-# Initialise git submodules if any are declared
-[ -f .gitmodules ] && git submodule update --init || true
+# Init only submodules that aren't checked out yet — first-clone
+# protection without touching already-initialized submodules (which
+# would yank in-progress branch work to detached HEAD on rebuild).
+if [ -f .gitmodules ]; then
+    missing=$(git submodule status | awk '/^-/ {print $2}')
+    [ -n "$missing" ] && git submodule update --init $missing
+fi