Revert to spec-compliant "privileged": true property

The devcontainer spec defines "privileged" as a cross-orchestrator
property for image/Dockerfile scenarios. Use it instead of runArgs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cuihtlauac

.devcontainer-from-scratch/devcontainer.json

@@ -2,7 +2,7 @@
   "name": "OCaml Development (Local Build)",
 
   // Required for TSan: allows sysctl -w vm.mmap_rnd_bits=28 at startup
-  "runArgs": ["--privileged"],
+  "privileged": true,
 
   "build": {
     "dockerfile": "../dev/Dockerfile",

.devcontainer/devcontainer.json

@@ -5,7 +5,7 @@
   "image": "cuihtlauac/ocaml-devcontainer:latest",
 
   // Required for TSan: allows sysctl -w vm.mmap_rnd_bits=28 at startup
-  "runArgs": ["--privileged"],
+  "privileged": true,
 
   "features": {
     "ghcr.io/anthropics/devcontainer-features/claude-code:1": {}