Demonstrate devcontainer and devenv-report against base-demo

[codeforester]

Context

Base v1.7.0 ships basectl devcontainer and basectl devenv-report. base-demo
is the natural released-project fixture for proving those read-only adapter
surfaces without making Dev Containers or Nix/devenv required for the baseline
demo.

Scope

• Add a base-demo demo/docs slice that shows basectl devcontainer base-demo
  and basectl devenv-report base-demo.
• Prefer dry-run/read-only output. Do not write .devcontainer/ as part of the
  default demo path.
• Add CI or test coverage that verifies the commands are discoverable against the
  pinned Base release.
• Update the tooling test-bed document and contract registry.

Acceptance Criteria

• base-demo demonstrates both commands without requiring Docker, VS Code, Nix, or
  devenv to be installed.
• The output is framed as compatibility evidence, not as generated committed
  environment ownership.
• Validation remains stable on macOS and Ubuntu CI.

Validation

• ./tests/validate.sh
• bats tests/demo_test.bats if the demo transcript changes
• GitHub Actions Validate Demo