Try to disable vscode from forwarding port 3000 and see if that resolves your problem.

I did the following:

1. Dropped http://localhost:3000/login-callback from the .opk/config.yml file in the container (vscode actually syncs my dotfiles, so the exact config I'm using is this with the local modification you suggested)
2. Ran opkssh login --disable-browser-open from within the container, which output:

INFO[0000] listening on http://127.0.0.1:10001/         
INFO[0000] press ctrl+c to stop                         
INFO[0000] Open your browser to: http://localhost:10001/login

3. Opened that url in my browser (outside of the container), which properly redirected me to https://auth.tswn.us/consent/openid/decision?flow=openid_connect&flow_id=[REMOVED FOR POST]. I'm using authelia, and I followed the guide to set this up. For completeness, the config I'm using in authelia can be seen here.
4. Clicked the Accept button on the prompt, which then redirected me to http://localhost:10001/login-callback?code=[REMOVED FOR POST]&iss=https%3A%2F%2Fauth.tswn.us&scope=openid+offline_access&state=[REMOVED FOR POST]
5. Saw the error "failed to get state: http: named cookie not present" in the page.

Just to be clear, I can run the same commands from my laptop (not in a container) and they work just fine. opkssh isn't running a server on the laptop when I'm trying to use it from the container either, so this should be the opkssh that is running from within the container with the forwarded port generating this error page.

I've been using the workaround for a bit now, successfully sshing into machines. I'm probably going to just use the IP address (127.0.0.1) in my config for authelia since I'm IPv4-only, anyway.

Apologies; my schedule has been a bit hectic and I hadn't had a chance to respond to your earlier response. I'll respond up there to keep the context in one place.