Prebuild: init submodule via PAT secret and build pg_durable

[pinodeca]

Summary

During the Codespace prebuild, use a GH_PAT Codespace secret to clone the private duroxide-pg-opt submodule, then build pg_durable. The PAT is scrubbed from the filesystem before the prebuild image is snapshotted.

Interactive Codespaces continue to use the token permissions granted via customizations.codespaces.repositories in devcontainer.json (merged in #93).

Changes

• onCreateCommand.sh: PAT-based submodule init with credential cleanup, fallback to default credentials, cargo build --features pg17 if submodule available
• postCreateCommand.sh: Verify submodule and build state when user opens Codespace
• CODESPACES_PREBUILDS.md: Document dual auth approach (PAT for prebuild, Codespace token for interactive use)

Auth mechanisms

Context	Mechanism
Prebuild (onCreateCommand)	GH_PAT Codespace secret — temporary git insteadOf rewrite, scrubbed after clone
Interactive Codespace	devcontainer.json codespaces.repositories token permissions
Local Dev Container	User's own credentials

Admin setup (one-time)

1. Create a fine-grained PAT scoped read-only to microsoft/duroxide-pg-opt (Contents: Read)
2. Go to repo Settings → Secrets and variables → Codespaces
3. Add secret: Name = GH_PAT, Value = the PAT
4. Trigger a prebuild rebuild

Security

• The PAT is injected as an env var (not persisted in filesystem snapshots)
• The temporary ~/.gitconfig entry is removed immediately after submodule clone
• Credential cache is explicitly rejected
• Belt-and-suspenders grep verifies no traces remain
• Users opening Codespaces from the prebuild never see or need the PAT