[chore](dev): keep one Delve server across hot reloads

Replace Air's kill-and-rerun loop in the debug image with the pilot
persistent-delve supervisor: src/dev/dlv-watch.sh owns one headless
`dlv exec --multiclient --continue` server, rebuilds ./tmp/main on save and
restarts only the debug target through the tiny rpc2 client in
src/dev/dlv-restart. An attached VS Code session (and its breakpoints) now
survives saves instead of reconnecting after every reload.

The debug compose builds locally with `pull_policy: build` and without
`build.network: host`: compose cannot grant the network.host entitlement, so
a cold `up` previously failed with "additional privileges requested"; the
default bridge reaches the dev Gitea for module resolution.

Dockerfile.debug

@@ -55,9 +55,11 @@ EXPOSE 2345
 # Set environment variables for development
 ENV GO111MODULE=on
 
-# Default command: run Air for hot reloading
-# Air will watch for changes and rebuild automatically
-CMD ["air", "-c", ".air.toml"]
+# Default command: persistent-delve hot-reload supervisor (src/dev/dlv-watch.sh).
+# Unlike Air, it never kills the dlv server, so an attached VS Code debug
+# session survives file saves (Delve's `restart` only re-launches the target).
+# src/ is live-mounted at /app, so this runs the in-repo copy you can edit.
+CMD ["bash", "/app/dev/dlv-watch.sh"]
 
 ##