devcontainer image build: FlashRank prewarm fails, core reranker seam never wired #617

Symptom

The scheduled ci.yml run of 2026-09-21 (run 35586189593, job 106290069933) failed at Docker Build (devcontainer image), step 9/9, deterministically on all 5 retries:

RuntimeError: reranker cache_dir provider not configured, call configure_reranker_filesystem() at the composition root first
FlashRank prewarm failed after 5 attempts

The HF/sentence-transformers prewarm on the line above it succeeds; only the FlashRank one fails.

Cause

.devcontainer/Dockerfile:103 calls mcp_server.core.reranker._ensure_reranker() directly in a bare python -c one-liner, without first calling mcp_server.hooks.wiring.wire_composition_root(). Since #568 (issue #560, commit 08453de), core/reranker_model.py requires configure_reranker_filesystem(...) to run before any core function that touches the reranker cache directory, exactly the seam-wiring rule issue #560 introduced across core/. The Dockerfile's inline prewarm command was never updated for it.

This is the same class of gap scripts/reclassify_team_scope.py had before #613: a script that reaches core/ without wiring the composition root first.

Scope, why this did not block a release

Docker Build (devcontainer image) is path-filtered by the changes job and is in ci-green's ALLOWED_SKIPS, so a push that does not touch Dockerfile-relevant paths skips it cleanly (verified on the 4.23.1 release push, run 35700002270: the job shows skipped, and ci-green passed). The bug only surfaces on the daily schedule run, or on any future PR that touches .devcontainer/Dockerfile, where it would fail for real rather than skip, and then block that PR's ci-green.

Fix

Call wire_composition_root() before _ensure_reranker() in the FlashRank prewarm line, the same pattern already used in scripts/backfill_write_class.py, scripts/collect_response_budget_payloads.py, and (since #613) scripts/reclassify_team_scope.py.