fix: New Codespace creation and rebuild enter recovery mode when moderation uv sync --locked fails

[chalew101]

Component

Codespace creation

Bug Description

Creating a new Codespace or rebuilding an existing Codespace from main causes container creation to fail. Codespaces then starts a recovery container instead of the configured Ubuntu development container.

I reproduced this during both new Codespace creation and a container rebuild.

The onCreateCommand runs on-create.sh and fails while restoring the moderation environment:
(cd scripts/evals/moderation && uv sync --locked)

The creation log reports:
Resolved 48 packages
The lockfile at uv.lock needs to be updated, but --locked was provided.
To update the lockfile, run uv lock.

onCreateCommand from devcontainer.json failed with exit code 1.
Container creation failed.
Creating recovery container.

Expected Behavior

The committed moderation lockfile should restore successfully, allowing new Codespaces and rebuilds to start in the configured Ubuntu development container.

Steps to Reproduce

1. Create a new Codespace from main, or run Codespaces: Rebuild Container in an existing Codespace.
2. Wait for the configured onCreateCommand to execute.
3. Observe that container creation fails and Codespaces enters recovery mode.

Additional Context