template: improve template metadata for discovery and clarity

[nozaq]

Summary

Five metadata fixes, all about information a user sees while searching for, browsing, applying, and then opening a template.

1. platforms now lists languages, not the OS

The Dev Container Template specification defines platforms as "Languages and platforms supported by the Template" — not the container OS. All ten templates declared ["linux"], so the field carried no signal for filtering the template list. Upstream templates use values like ["Go"].

Template	platforms	Version
golang	["Go"]	1.2.6 → 1.2.7
node	["Node.js"]	1.1.1 → 1.1.2
uv	["Python"]	1.0.6 → 1.0.7
rustup	["Rust"]	1.4.1 → 1.4.2
zig	["Zig"]	1.2.6 → 1.2.7
terraform	["Terraform"]	1.2.5 → 1.2.6
bun	["Bun", "JavaScript", "TypeScript"]	1.0.5 → 1.0.6
deno	["Deno", "JavaScript", "TypeScript"]	1.0.1 → 1.0.2
debian	["Any"]	1.2.6 → 1.2.7
mise	["Any"]	1.3.2 → 1.3.3

debian and mise are not tied to a single toolchain, so they use Any. One version bump per template covers every change in this pull request.

2. imageVariant descriptions answer "which value do I pick?"

The old descriptions restated the value format ("Go version and Debian version") and left three questions unanswered: which Debian release trixie and bookworm are, whether proposals is a closed list (it is not — the field is not an enum), and where the published tags can be found.

-"description": "Go version and Debian version",
+"description": "Go and Debian version (trixie = Debian 13, bookworm = Debian 12). Other published tags can be entered.",

Two fixed forms are used, depending on whether the tag pins a toolchain version:

• <Toolchain> and Debian version (trixie = Debian 13, bookworm = Debian 12). Other published tags can be entered. — bun, deno, golang, node, terraform, zig
• Debian version (trixie = Debian 13, bookworm = Debian 12). Other published tags can be entered. — debian, mise, rustup, uv

A description cannot hold the tag-list URL within a sane length, so each template also gains an Image Variants section in NOTES.md (and the generated README.md) that links to the base image's published tags and repeats the codename mapping — keeping each template page self-contained.

3. keywords optimized as search terms

keywords are "strings relevant to a user that would search for this Template", yet the hardening that distinguishes this repository was not searchable — no template listed a single security-related term.

• All ten templates gain security, hardened, non-root.
• node: corepack, pnpm, yarn — the image ships no npm, so Corepack is how a user drives package managers here.
• uv: astral, ruff — the template bundles the Ruff extension and sets it as the Python formatter.
• terraform: terraform-ls — configured via terraform.languageServer.path. OpenTofu is deliberately left out since it is not shipped.

4. The uv container name matches the template name

The uv template is listed as Python (uv) but generated "name": "uv", so the editor window title disagreed with the entry the user picked from the list. Every other template already matches (golang → Go, rustup → Rust), so uv was the lone exception.

The container is renamed to Python (uv), and the repository README uses the same label in its template table and in the example output under What You Get.

5. Descriptions spend their budget on template-specific detail

Four descriptions filled the 88-character budget with wording every template shares, leaving nothing that identifies the template itself.

-Security-focused mise dev container for multiple runtimes, with rebuild-friendly caches.
+Security-focused mise dev container for multiple runtimes, with cached tool installs.
-Security-focused Node.js dev container for JS/TS with hardened, non-root defaults.
+Security-focused Node.js dev container for JS/TS with non-root defaults and Corepack.
-Security-focused Terraform dev container with terraform-ls and rebuild-friendly caching.
+Security-focused Terraform dev container with terraform-ls and a plugin cache volume.
-Security-focused minimal Debian base for any stack, with hardened container defaults.
+Security-focused minimal Debian base for any stack, with hardened, non-root defaults.

The shared Security-focused prefix is kept deliberately. Every surface that shows a description — the VS Code template picker, the README table, the registry listing — shows the template name right next to it, so leading with the toolchain would repeat what is already on screen. The prefix earns its place in the case that actually needs a tiebreaker: a user who has already filtered by their stack and is comparing this template against another one with the same name, where the hardening is the reason to pick this one. AGENTS.md records that reasoning so the prefix is not dropped by accident.

Conventions and CI

• AGENTS.md gains a Template Metadata section recording the platforms rule, the two description forms, the "proposals is a shortlist, not an enum" rule, the name-matching rule, the keyword convention, the description-prefix rationale, and the version-bump expectation. Image Variants is added to the documented NOTES.md section order.
• The CI description-length job now checks option descriptions as well.

Note on the length limit

The imageVariant wording does not fit the existing 88-character budget — the longest, terraform, is 109 characters — so option descriptions are capped at 120 while the template description stays at 88. The two render in different places: the template description is the one-line headline in the template list, while an option description is a table cell in the README and a prompt while applying. If you would rather have a single shared limit, the option descriptions can be tightened to fit 88 instead (roughly, by shortening bookworm = Debian 12 to bookworm = 12 and the trailing sentence to other tags accepted).

Verification

• jq parses every devcontainer-template.json; the length check passes locally (every template description is 83–88 characters) and fails as expected on a 121-character option description.
• Every NOTES.md body is still embedded verbatim in its generated README.md, and the README.md options tables and description lines carry the new text.
• Published tag links were checked against GHCR; the per-template examples of "narrower tags" match what each image actually publishes (debian publishes only codename and date-stamped tags, so its wording differs).
• Each added keyword was checked against the template's own devcontainer.json — the Ruff extension, the terraform-ls setting, and the Corepack cache mount are all present.
• All ten templates now report an identical name in devcontainer-template.json and .devcontainer/devcontainer.json.