feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

.env.example

@@ -2,9 +2,17 @@ PORT=8787
 HOST=0.0.0.0
 LOG_LEVEL=info
 TJWATER_SERVER_TIMEOUT_MS=10000
+TJWATER_SERVER_BASE_URL=http://127.0.0.1:8000
+
+CONVERSATION_WORKSPACE_ROOT=./.agent-workspaces
+SANDBOX_MAX_OUTPUT_BYTES=1048576
 
 OPENCODE_MODE=embedded
-OPENCODE_MODEL=deepseek/deepseek-v4-flash
+# OpenCode 2 CLI 路径或命令；默认 opencode2。
+OPENCODE_COMMAND=opencode2
+# client 模式连接私有 V2 server 时，填写其 server password（不要提交实际值）。
+# OPENCODE_CLIENT_PASSWORD=
+OPENCODE_MODEL=deepseek/deepseek-flash
 # 可选：后台工况任务首选模型，必须同时出现在 OPENCODE_MODEL_OPTIONS 中。
 # OPERATIONAL_TASK_MODEL=deepseek/deepseek-v4-pro
 OPENCODE_HOSTNAME=127.0.0.1
@@ -16,7 +24,3 @@ AGENT_LOCAL_USER_ID=local-user
 # 必须填写 Server /api/v1/projects 返回的项目 UUID。
 AGENT_LOCAL_PROJECT_ID=00000000-0000-0000-0000-000000000000
 AGENT_LOCAL_NETWORK=local-network
-
-TJWATER_API_BASE_URL=http://127.0.0.1:8000
-TJWATER_API_ENABLED=true
-TJWATER_AUTH_MODE=disabled