feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

.opencode/tool.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+export type ToolContext = { sessionID: string; callID?: string; signal?: AbortSignal };
+
+// Keep business schemas and executors independent from OpenCode's plugin API.
+export function tool<Args extends z.ZodRawShape>(definition: {
+  description: string;
+  args: Args;
+  execute(args: z.infer<z.ZodObject<Args>>, context: ToolContext): Promise<string>;
+}) {
+  return definition;
+}
+
+tool.schema = z;