Updated extensions and global .gitignore

Dockerfile

@@ -32,8 +32,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libssl-dev \
     zlib1g-dev \
     libbz2-dev \
+    liblzma-dev \
     libreadline-dev \
     libsqlite3-dev \
+    libncursesw5-dev \
+    xz-utils \
+    uuid-dev \
     zsh \
     fd-find \
     ripgrep \
@@ -103,6 +107,13 @@ RUN ARCH=$(dpkg --print-architecture) && \
     curl -fsSL https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl -o /usr/local/bin/kubectl && \
     chmod +x /usr/local/bin/kubectl
 
+
+# yq (mikefarah)
+ARG YQ_VERSION=v4.44.3
+RUN ARCH=$(dpkg --print-architecture) && \
+    curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${ARCH}" -o /usr/local/bin/yq && \
+    chmod +x /usr/local/bin/yq
+
 # Helm
 RUN curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
@@ -140,6 +151,14 @@ RUN mkdir -p -m 755 /etc/apt/keyrings && \
     apt-get update && apt-get install -y acli && \
     rm -rf /var/lib/apt/lists/*
 
+# GitHub CLI (gh)
+RUN mkdir -p -m 755 /etc/apt/keyrings && \
+    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
+    chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list && \
+    apt-get update && apt-get install -y gh && \
+    rm -rf /var/lib/apt/lists/*
+
 # Rust
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
@@ -166,6 +185,11 @@ RUN if [ -f /tmp/build-context/aws-config ]; then \
         mkdir -p /root/.aws && mv /tmp/build-context/aws-config /root/.aws/config; \
     fi && rm -rf /tmp/build-context
 
+# Global gitignore: lives on the host at ~/repos/dev_sandbox/.gitignore_global
+# (bind-mounted to /workspace/dev_sandbox/.gitignore_global). Symlinked into
+# place by entrypoint.sh so host edits take effect without a rebuild.
+RUN git config --system core.excludesfile /root/.gitignore_global
+
 # Pi wrapper script (optional, only applied if bin/pi exists in build context)
 COPY Dockerfile bin/p* /tmp/build-context/
 RUN if [ -f /tmp/build-context/pi ]; then \