feat: limit medium-probability cards and sync Docker dev dependencies

docker/dev-entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+cd /app
+
+# Reused dependency volumes can lag behind the bind-mounted source tree.
+# Include the Node runtime so native modules are refreshed after image upgrades.
+dependency_hash="$(
+  {
+    sha256sum package.json package-lock.json
+    node -p 'process.version + ":" + process.platform + ":" + process.arch'
+  } | sha256sum | cut -d ' ' -f 1
+)"
+stamp_path="node_modules/.holodream-dependencies"
+installed_hash="$(cat "$stamp_path" 2>/dev/null || true)"
+
+if [ "$dependency_hash" != "$installed_hash" ]; then
+  echo 'Synchronizing development dependencies with package-lock.json...'
+  npm ci --include=dev
+  printf '%s\n' "$dependency_hash" > "$stamp_path"
+fi
+
+exec "$@"