feat: add atlassian-teamwork-graph-cli dev container feature

[rosstaco]

Summary

Adds a new atlassian-teamwork-graph-cli Feature that installs Atlassian's Teamwork Graph CLI (twg). twg complements acli, and the two Features can be used together. It's a separate Feature because twg covers much more than Jira and Confluence (Bitbucket, JSM, Loom, Trello and more), so it doesn't fit the existing atlassian-jira-confluence-cli id.

Why not the official installer?

curl …/cli/install | bash runs twg setup finalize after downloading the binary. That step records consent, installs skills and starts OAuth login on /dev/tty, so the install is interactive. This Feature downloads the binary directly from the same CDN (latest comes from manifest.json) and checks it against the published SHA256SUMS. The user then runs twg login (device-code OAuth) themselves.

Options

Option	Default	Notes
version	latest	Atlassian blocks versions below a published minimum
installSkills	false	twg skills install --yes as the remote user (~/.agents/skills, ~/.claude/skills)
enableTelemetry	false	When false, exports DO_NOT_TRACK=1 and TWG_DISABLE_3P_DATA_TELEMETRY=1 via env.sh, /etc/profile.d and a chained BASH_ENV (the package-source-overrides pattern)
persistAuth	true	Links ~/.config/twg to a ${devcontainerId}-twg-config volume. The volume is always mounted, because mounts can't depend on options
configureBrowser	true	Same $BROWSER-aware xdg-open shim as the acli Feature

• Installs to the remote user's ~/.local/bin/twg, owned by that user so twg upgrade works without sudo, with a /usr/local/bin/twg symlink.
• The README documents passing TWG_TOKEN, TWG_USER and TWG_SITE through remoteEnv with ${localEnv:…}. A Feature's containerEnv is baked into the image, so the Feature can't do this safely itself.

Also

• CI matrix entries, justfile targets, root README section and the generated feature README.

Testing

Run locally with devcontainer features test:

• autogenerated test on debian:latest (root): ✅
• scenarios version (pinned 1.3.5 and ownership for the vscode user), skills, opt-outs: ✅
• checked by hand: twg login shows the device-code prompt and no consent prompt, and twg upgrade --check works without the installer's install.json.