feat(container): 公開イメージの touch-file ベース定期 pull を追加

Codex review [1.1] 対応で削除した「公開イメージの定期再 pull」を、
touch-file 方式で再実装。

実装:
- _pull_marker_path(image): \${DEVBASE_ROOT}/.cache/pulls/<safe-name>
  image 名の '/' や ':' を '_' に置換してファイル名安全化
- _pull_age_days(image): touch-file mtime からの経過日数 (None=未存在)
- _mark_pulled(image): pull 成功時に marker を touch
- _ensure_images() の image-only 分岐:
  - 不在 → pull → mark
  - 前回 pull から N 日経過 → pull → mark
  - それ以外 → no-op

メリット:
- JSON parse 不要 (pathlib + time だけ)
- 中断耐性 (壊れた JSON が残らない)
- 手動リセット容易 (rm .cache/pulls/foo で次回再 pull)
- 約 30 行で完結

副次:
- .gitignore に .cache/ を追加
- cli-reference.md に touch-file 仕様を追記

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: takemi-ohama

.gitignore

@@ -10,3 +10,4 @@ projects/*
 !projects/.gitkeep
 .env.sources.yml
 issues/
+.cache/

docs/user/cli-reference.md

@@ -105,6 +105,8 @@ devbase up
   - `build:` 定義あり、イメージ未存在 → `devbase build` を自動実行
   - `build:` 定義あり、イメージが7日以上古い → `devbase build --no-cache` で再ビルド
   - `image:` のみ（公開イメージ）、未存在 → `docker pull` を自動実行
+  - `image:` のみ、前回 pull から7日以上経過 → `docker pull` で再取得
+    （前回 pull 日時は `${DEVBASE_ROOT}/.cache/pulls/<image>` の touch-file mtime で判定）
   - 閾値は `DEVBASE_IMAGE_MAX_AGE_DAYS` 環境変数で上書き可能（既定 7、不正値は警告して既定値）
 
 ### `devbase container down`

lib/devbase/commands/container.py

@@ -5,6 +5,7 @@
 import re
 import subprocess
 import sys
+import time
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
@@ -443,11 +444,11 @@ def _ensure_images() -> bool:
       - Image missing + has build: → run `devbase build`
       - Image missing + image-only (no build:) → run `docker pull`
       - Image present and >= threshold days old + has build:
-        → rebuild with `--no-cache`
-      - Image present + image-only → nothing to do
-        (Created reflects upstream build time, not local pull time, so we
-        cannot derive a meaningful freshness signal here. Users who want
-        public images refreshed should run `docker pull` explicitly.)
+        → rebuild with `--no-cache` (uses image 'Created' timestamp)
+      - Image present + image-only + last-pull >= threshold days old
+        → run `docker pull` (uses local touch-file mtime, since image
+        'Created' reflects upstream build time and is not a meaningful
+        local-freshness signal)
       - Otherwise: nothing to do
 
     Returns True on success or no-op, False on failure.
@@ -495,14 +496,28 @@ def _ensure_images() -> bool:
                 logger.info("Running 'devbase container build' to create it...")
                 return _run_build()
             logger.info("Container image '%s' not found, pulling...", image_name)
-            return _run_pull(image_name)
+            ok = _run_pull(image_name)
+            if ok:
+                _mark_pulled(image_name)
+            return ok
 
-        # Image-only services: 'Created' reflects upstream build time, not
-        # local pull time, so age-based re-pull is not meaningful. Skip.
+        max_age = _image_max_age_days()
+
+        # Image-only services: use local touch-file mtime, since image
+        # 'Created' reflects upstream build time, not local pull time.
         if not has_build:
-            return True
+            pull_age = _pull_age_days(image_name)
+            if pull_age is None or pull_age < max_age:
+                return True
+            logger.info(
+                "Image '%s' last pulled %d days ago (>= %d days threshold), re-pulling...",
+                image_name, pull_age, max_age
+            )
+            ok = _run_pull(image_name)
+            if ok:
+                _mark_pulled(image_name)
+            return ok
 
-        max_age = _image_max_age_days()
         age_days = _get_image_age_days(inspect.stdout)
         if age_days is None or age_days < max_age:
             return True
@@ -578,6 +593,38 @@ def _run_pull(image_name: str) -> bool:
         return False
 
 
+def _pull_marker_path(image_name: str) -> Optional[Path]:
+    """Path of the touch-file recording the last pull time of `image_name`.
+
+    Returns None when DEVBASE_ROOT is not set so callers can no-op safely.
+    """
+    devbase_root = os.environ.get('DEVBASE_ROOT')
+    if not devbase_root:
+        return None
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', image_name)
+    return Path(devbase_root) / '.cache' / 'pulls' / safe
+
+
+def _pull_age_days(image_name: str) -> Optional[int]:
+    """Days since the last successful pull of `image_name`. None if never."""
+    marker = _pull_marker_path(image_name)
+    if marker is None or not marker.exists():
+        return None
+    return int((time.time() - marker.stat().st_mtime) / 86400)
+
+
+def _mark_pulled(image_name: str) -> None:
+    """Touch the marker file to record a successful pull."""
+    marker = _pull_marker_path(image_name)
+    if marker is None:
+        return
+    try:
+        marker.parent.mkdir(parents=True, exist_ok=True)
+        marker.touch()
+    except OSError as e:
+        logger.warning("Could not write pull marker for '%s': %s", image_name, e)
+
+
 def _update_scale_in_env(new_scale: int) -> bool:
     """Update CONTAINER_SCALE value in env file"""
     env_file = Path('./env')