feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

.opencode/tools/external_information.ts

@@ -0,0 +1,14 @@
+import { getInternalBridgeConfig } from "../internalBridge.js";
+import { type ToolContext } from "../tool.js";
+
+export async function requestExternalInformation(name: "web-search" | "geocode", input: unknown, context: ToolContext) {
+  const { baseUrl, internalToken } = getInternalBridgeConfig();
+  const response = await fetch(`${baseUrl}/internal/tools/${name}`, {
+    method: "POST", signal: context.signal,
+    headers: { "Content-Type": "application/json", "x-agent-internal-token": internalToken },
+    body: JSON.stringify({ session_id: context.sessionID, input }),
+  });
+  const text = await response.text();
+  if (!response.ok) throw new Error(`external information failed (${response.status}): ${text}`);
+  return text;
+}