Refresh devcontainer stack and fix two latent build bugs

[pbrady]

Bump the pinned versions in the devcontainer/CI image and fix two things
that were broken but silent.

Version bumps:

• spack-packages: develop commit -> tag v2026.06.0, which now ships
  kokkos 5.1.1. This removes the duplicated SHA that lived in both the
  Dockerfile and spack.yaml (only the Dockerfile's took effect).
• spack: v1.1.1 -> v1.2.2
• python base image: 3.11-slim -> 3.13-slim (stencil_gen suite passes on
  3.13: 1215 passed, 163 skipped; uv sync --locked is clean)
• git-delta: 0.18.2 -> 0.19.2 (0.19.0/0.19.1 shipped broken debs)
• actions/checkout v6 -> v7, actions/cache v5 -> v6

Bug fixes:

• clang was never actually installed from apt.llvm.org: the repo added for
  Debian trixie is empty, so the source list was inert and would hard-fail
  on the next Debian bump. Now probes the distro archive first and only
  adds apt.llvm.org when the distro lacks the version.
• sudo could never work in the devcontainer: the user was not in the sudo
  group and there was no NOPASSWD drop-in.

Cleanups:

• Delete .devcontainer/.dockerignore. Docker never read it (both build
  entry points use the repo root as context) and it contradicted the root
  one, which is an allowlist.
• Drop the Makefile's gcc/clang targets. They passed a SPACK_COMPILER
  build arg no stage declares, so the two images were byte-identical.
• Read the spack-packages pin out of spack.yaml instead of restating it,
  with a CI guard asserting the manifest carries exactly one tag: line.
• devcontainer-image.yml timeout 350 -> 120. GitHub hard-caps a job at
  360 minutes, so 350 was no protection; with cancel-in-progress false a
  wedged build would block the queue for hours.

Verified on arm64: ci stage builds in ~11 min and passes ctest 47/48
(t-laplacian still fails, per docs/CLEANUP_PLAN.md 0a); final stage
smoke-tests clean including sudo, zsh login shell, and spack env
activation showing kokkos@5.1.1.