Perf: aidc up/claude should skip --build when image is fresh (fast path + pin agents)

[ai-anant]

Problem

aidc claude / aidc up always runs docker compose up -d --build (lib/aidc.sh:240), which forces Docker to re-evaluate the build on every start. Combined with unpinned curl | bash agent installers (latest versions fetched at build time), any layer-cache miss triggers a full ~3 GB re-install — the "every aidc claude or aidc start results in a large ~4GB container" experience.

Proposal

1. Fast path in aidc up: if the compose image already exists and the Dockerfile/compose haven't changed (check docker image inspect + mtime/hash of .devcontainer/Dockerfile and compose.yaml), run docker compose up -d without --build. Only run --build when the image is missing or the files changed. (This mirrors what aidc rebuild is for — rebuild keeps forcing the build.)
2. Pin agent installs (versions + SHA256 where the vendor provides them) so the agent layer is deterministic and the layer cache is actually reusable across projects. Unpinned latest installers silently change layer digests and defeat Docker's cache.
3. Optionally: AIDC_NO_BUILD=1 env escape hatch for users who want up to never build.

Expected impact

• aidc claude on an already-built project: near-instant (no build evaluation, no downloads).
• Build cache stops accumulating ~3 GB of re-downloads per project per bump.
• Reproducible agent versions (also a supply-chain win — same "revoke a bad tool once" story as Image size: build a prebuilt shared aidc-base image so projects don't rebuild ~3GB of common tooling #7).

Files

• lib/aidc.sh — aidc::cmd_up, aidc::cmd_rebuild
• templates/devcontainer/Dockerfile.tmpl — agent install block (pin versions)

Acceptance criteria

• aidc up twice in a row: second run does not invoke docker build (verify with --progress output or build log).
• aidc rebuild still forces a rebuild.
• aidc up on a repo whose Dockerfile changed triggers a build.