feat: add ubuntu version-specific image tags

[matifali]

Summary

Adds Ubuntu version-specific image tags so users can pin to a specific Ubuntu release and avoid unexpected breakage when the base image changes.

Problem

The :ubuntu tag is rolling — it follows whatever Ubuntu version the Dockerfiles currently use. When we bump versions (e.g., 22.04 → 24.04), workspaces can break unexpectedly, as reported in #282.

Approach

Define UBUNTU_VERSION once in scripts/images.sh. Everything else reads that variable:

• Dockerfiles consume it via ARG UBUNTU_VERSION in their FROM line
• Build script passes it as --build-arg
• Push script uses it directly to generate version-specific tags

No runtime detection, no sidecar files, no docker run at push time.

Changes

• scripts/images.sh — Added UBUNTU_VERSION="noble" as the single source of truth
• images/base/ubuntu.Dockerfile — FROM ubuntu:${UBUNTU_VERSION}
• images/minimal/ubuntu.Dockerfile — FROM ubuntu:${UBUNTU_VERSION}
• images/universal/ubuntu.Dockerfile — FROM mcr.microsoft.com/devcontainers/universal:${UBUNTU_VERSION}
• scripts/build_images.sh — Passes --build-arg UBUNTU_VERSION
• scripts/push_images.sh — Pushes ubuntu-{version} and ubuntu-{version}-{date} tags
• README.md — Tag reference table
• Derivative images (golang, java, node, desktop) unchanged — they inherit from locally-built base/minimal

Closes #282

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑💻

[matifali]

@johnstcn, do you have better ideas to do this? For images where we control the Dockerfile, I was thinking we could use FROM ubuntu:<version>, but for the universal image, that wouldn't be possible, as we build on a 3rd-party base image we do not control.

[johnstcn]

@johnstcn, do you have better ideas to do this? For images where we control the Dockerfile, I was thinking we could use FROM ubuntu:<version>, but for the universal image, that wouldn't be possible, as we build on a 3rd-party base image we do not control.

There is a set of tags we can reference here. We can't 100% rely on stability of those tags though (especially e.g. noble versus 5.1.4-noble). If we want 100% reliability we'd need to roll our own "universal" image.

The source of the universal devcontainer is available here though...

[matifali]

Yeah. That's a base image for the universal and then they add most tools via devcontainer features.

I will adjust it to relay in base image tags.

[matifali]

Updated. Let me know what you think now.

[johnstcn]