feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

src/routes/chatSessionRoutes.ts

@@ -1,3 +1,4 @@
+import { credentialRefreshCoordinator } from "../product/credential-refresh.js";
 import { type Router } from "express";
 import { z } from "zod";
 
@@ -576,6 +577,10 @@ export const registerChatSessionRoutes = (
       },
     };
     run.subscribers.add(subscriber);
+    const pendingRefresh = credentialRefreshCoordinator.getPendingEvent(sessionRecord.sessionId);
+    if (pendingRefresh) subscriber.write(pendingRefresh.type, {
+      ...pendingRefresh, session_id: sessionRecord.sessionId, request_id: pendingRefresh.requestId,
+    });
 
     const cleanup = () => {
       run.subscribers.delete(subscriber);