fix: restore truncated devcontainer.json

[Olisachukwuma1]

.devcontainer/devcontainer.json

• Official Rust base image (mcr.microsoft.com/devcontainers/rust:1-bullseye)
• rust-analyzer configured for wasm32-unknown-unknown target
• Clippy on save, format on save, LLDB debugger
• SOROBAN_NETWORK=testnet set as default env

.devcontainer/post-create.sh

• Adds wasm32-unknown-unknown target
• Installs soroban-cli (locked, v21 — matches soroban-sdk = "21.0.0")
• Installs cargo-expand and cargo-watch
• Pre-builds the project so first cargo test is fast

CONTRIBUTING.md

• New "Development environment" section with one-click VS Code and
  Codespaces badges, post-container verification steps, and manual
  setup fallback

docs/reentrancy-audit.md (new)

Full reentrancy audit of has_valid_claim, all #[contractimpl] pub
fns, and every event emission site.

ID	Risk	Finding
F-01	Low	maybe_trigger_expiration_hook — stored-address cross-contract call, no state write in caller
F-02	Low	charge_attestation_fee — TokenClient called before store_attestation
F-03	Info	cosign_attestation — ms_sign event emitted before threshold-branch state write
F-04	Medium	Integrator pattern — caller-supplied TrustLink address accepted as runtime param

closes #97