feat(code-server): give the workspace its own volume

The workspace moves off the config volume onto code-server-workspace, so
wiping editor state and wiping code are separate acts.

The image only ever chowns the literal path /config/workspace, and reads
DEFAULT_WORKSPACE to pick the folder to open, so a named volume on /workspace
would come up root-owned and unwritable. Creating the directory in a local
Dockerfile seeds the volume with the right ownership instead.

code-server/Dockerfile

@@ -0,0 +1,4 @@
+FROM lscr.io/linuxserver/code-server:latest
+
+# Workspace directory, owned by the container user.
+RUN mkdir -p /workspace && chown 1000:1000 /workspace