feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

package.json

@@ -18,7 +18,7 @@
     "start:prod": "bun run check && bun src/server.ts"
   },
   "dependencies": {
-    "@opencode-ai/sdk": "^1.17.13",
+    "@opencode/client": "2.0.24",
     "ai": "7.0.8",
     "cors": "^2.8.5",
     "dotenv": "^17.2.3",
@@ -32,7 +32,8 @@
     "@types/express": "^5.0.3",
     "@types/node": "^24.7.2",
     "bun-types": "^1.3.3",
-    "typescript": "^5.9.3"
-    ,"openapi-typescript": "^7.10.1"
+    "typescript": "^5.9.3",
+    "openapi-typescript": "^7.10.1",
+    "@opencode-ai/sdk": "^1.17.13"
   }
 }