Scope Bake entitlement workaround to affected Compose versions

Set BUILDX_BAKE_ENTITLEMENTS_FS=0 for Compose 2.38.2 and 5.6.0 in the affected CI jobs. Leave other versions and installed tools unchanged. This minimal alternative to #1330 and #1331 avoids probes or downloads and explicitly warns about disabled filesystem and SSH-agent consent checks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: chrmarti

.github/actions/setup-compose/action.yml

@@ -0,0 +1,18 @@
+name: Set up Compose build workaround
+description: Disable Bake filesystem entitlement checks for the affected runner Compose versions.
+
+runs:
+  using: composite
+  steps:
+  - name: Check Compose version
+    shell: bash
+    run: |
+      version=$(docker compose version --short)
+      echo "Compose version: $version"
+      # Temporary workaround for https://github.com/devcontainers/cli/issues/1320.
+      case "${version#v}" in
+        2.38.2|5.6.0)
+          echo "::warning::Disabling Bake filesystem and default SSH-agent consent checks for Compose $version."
+          echo "BUILDX_BAKE_ENTITLEMENTS_FS=0" >> "$GITHUB_ENV"
+          ;;
+      esac

.github/workflows/dev-containers.yml

@@ -104,6 +104,7 @@ jobs:
       run: yarn type-check
     - name: Package
       run: yarn package
+    - uses: ./.github/actions/setup-compose
     - name: Run Tests
       run: yarn test-matrix --forbid-only ${{ matrix.mocha-args }}
       env:

.github/workflows/test-docker-v29.yml

@@ -29,6 +29,8 @@ jobs:
         sudo VERSION=29.0.0 sh get-docker.sh
         sudo systemctl restart docker
     
+    - uses: ./.github/actions/setup-compose
+
     - name: Verify Docker version, Install and Test
       run: |
         # Verify