feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

tests/opencode/disabledTools.test.ts

@@ -2,11 +2,9 @@ import { describe, expect, it } from "bun:test";
 import { existsSync } from "node:fs";
 
 const disabledServerTools = [
-  "geocode",
   "get_project_context",
   "list_scada_assets",
   "query_scada_readings",
-  "web_search",
 ];
 
 describe("disabled opencode tools", () => {
@@ -15,10 +13,12 @@ describe("disabled opencode tools", () => {
       expect(existsSync(`.opencode/tools/${toolName}.ts`)).toBeFalse();
     }
     expect(existsSync(".opencode/tools/server_api_shared.ts")).toBeFalse();
-    expect(existsSync(".opencode/tools/zoom_to_map.ts")).toBeFalse();
+    expect(existsSync(".opencode/tools/web_search.ts")).toBeTrue();
+    expect(existsSync(".opencode/tools/geocode.ts")).toBeTrue();
+    expect(existsSync(".opencode/tools/zoom_to_map.ts")).toBeTrue();
     expect(existsSync(".opencode/tools/frontend_action.ts")).toBeTrue();
     expect(existsSync(".opencode/tools/render_scada_analysis.ts")).toBeTrue();
     expect(existsSync(".opencode/tools/clear_scada_analysis.ts")).toBeTrue();
-    expect(existsSync(".opencode/plugins/frontend-action-call-id.ts")).toBeTrue();
+    expect(existsSync(".opencode/plugins/tjwater-tools.ts")).toBeTrue();
   });
 });