feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

.opencode/tools/query_project_data.ts

@@ -0,0 +1,28 @@
+import { tool } from "../tool.js";
+import { getInternalBridgeConfig } from "../internalBridge.js";
+
+export default tool({
+  description: "读取当前可信项目的供水数据。支持元素属性、SCADA 设备及最多24小时的历史、元素历史、分析运行和分页结果。仅使用 source 所需字段；禁止指定 URL、项目、network、header 或命令。分析数据不完整时明确缺口。",
+  args: {
+    source: tool.schema.enum(["element_properties", "scada_devices", "scada_history", "element_history", "analysis_runs", "analysis_run", "analysis_results"]),
+    element_type: tool.schema.enum(["junction", "pipe", "valve", "pump", "tank", "reservoir"]).optional(),
+    element_id: tool.schema.string().optional(),
+    device_ids: tool.schema.array(tool.schema.string()).optional(),
+    field: tool.schema.enum(["monitored_value", "cleaned_value"]).optional().describe("原始监测值或清洗值；物理指标与单位以设备元数据为准。"),
+    start: tool.schema.string().optional(),
+    end: tool.schema.string().optional(),
+    run_id: tool.schema.string().optional(),
+    limit: tool.schema.number().int().optional(),
+    offset: tool.schema.number().int().optional(),
+  },
+  async execute(query, context) {
+    const { baseUrl, internalToken } = getInternalBridgeConfig();
+    const response = await fetch(`${baseUrl}/internal/tools/project-data`, {
+      method: "POST", headers: { "Content-Type": "application/json", "x-agent-internal-token": internalToken },
+      body: JSON.stringify({ session_id: context.sessionID, query }),
+    });
+    const text = await response.text();
+    if (!response.ok) throw new Error(`project data query failed (${response.status}): ${text}`);
+    return text;
+  },
+});