feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

src/routes/chatStreamEvents.ts

@@ -299,6 +299,10 @@ export const normalizeQuestionToolPayload = (
   params: Record<string, unknown>,
   clientSessionId: string,
 ): QuestionRequestPayload | undefined => {
+  // Native V2 question tools create a separate frm_ request. A call ID is not a form ID.
+  if ("metadata" in part.state && part.state.metadata?.native_form === true) {
+    return undefined;
+  }
   if (!questionToolNames.has(part.tool)) {
     return undefined;
   }