feat(agent): migrate OpenCode 2 runtime and sandbox tools

Upgrade the runtime and native plugin API to OpenCode 2.0.24. Restore
session-scoped learning, credential renewal, typed project queries and
controlled frontend actions from the legacy Agent.

Replace host Shell execution with an approved Landlock/seccomp executor
and persistent per-session workspaces. Add typed Bocha search and Tianditu
geocoding bridges using the owning session credential. Require a working
kernel sandbox before startup and persist workspace files in deployments.

Validation completed before this commit: TypeScript checks, 150 Bun tests,
Docker build and UID 10001 sandbox execution, native Shell approval and
session recovery. Tianditu succeeded; Bocha currently reports exhausted
account quota. Unrelated investigation-report contract work is excluded.

tests/runtime/opencodeConfig.test.ts

@@ -1,38 +1,23 @@
-import { describe, expect, it, test } from "bun:test";
+import { describe, expect, it } from "bun:test";
 import { readFile } from "node:fs/promises";
 
-describe("internal OpenCode permissions", () => {
-  it("keeps protected paths denied in every approval mode", async () => {
-    const config = JSON.parse(await readFile("opencode.json", "utf8")) as {
-      permission?: Record<string, string | Record<string, string>>;
-    };
-    const permission = config.permission ?? {};
-    const bash = permission.bash as Record<string, string> | undefined;
-    const edit = permission.edit as Record<string, string> | undefined;
-    const read = permission.read as Record<string, string> | undefined;
-
-    expect(permission["*"]).toBe("ask");
-    expect(permission.external_directory).toBe("deny");
-    expect(permission.task).toBe("deny");
-    expect(permission.question).toBe("allow");
-    expect(permission.todowrite).toBe("allow");
-    expect(read?.["*"]).toBe("allow");
-    expect(read?.["data/**"]).toBe("deny");
-    expect(read?.["**/logs/**"]).toBe("deny");
-    expect(edit?.["*"]).toBe("ask");
-    expect(edit?.["data/**"]).toBe("deny");
-    expect(edit?.["**/logs/**"]).toBe("deny");
-    expect(bash?.["*"]).toBe("ask");
-    expect(bash?.["*.env*"]).toBe("deny");
-    expect(bash?.["*data/*"]).toBe("deny");
-    expect(bash?.["*logs/*"]).toBe("deny");
-  });
-});
-
-describe("OpenCode runtime config", () => {
-  test("continues the agent loop after a question or permission is denied", async () => {
-    const config = await Bun.file(new URL("../../opencode.json", import.meta.url)).json();
-
-    expect(config.experimental?.continue_loop_on_deny).toBe(true);
+describe("OpenCode 2 permissions", () => {
+  it("keeps protected paths denied, shell/edit gated and subagents disabled", async () => {
+    const config = JSON.parse(await readFile("opencode.json", "utf8"));
+    const rules = config.permissions as { action: string; resource: string; effect: string }[];
+    const effect = (action: string, resource: string) => rules.find((rule) => rule.action === action && rule.resource === resource)?.effect;
+    expect(effect("*", "*")).toBe("ask");
+    expect(effect("external_directory", "*")).toBe("deny");
+    expect(effect("subagent", "*")).toBe("deny");
+    expect(effect("question", "*")).toBe("allow");
+    expect(effect("todowrite", "*")).toBe("allow");
+    for (const action of ["read", "edit"]) {
+      for (const path of [".env", "*.env", "data/**", "**/logs/**"]) expect(effect(action, path)).toBe("deny");
+    }
+    expect(effect("edit", "*")).toBe("ask");
+    expect(effect("shell", "*")).toBe("ask");
+    for (const pattern of ["*.env*", "*data/*", "*logs/*"]) expect(effect("shell", pattern)).toBe("deny");
+    expect(config.permission).toBeUndefined();
+    expect(config.experimental?.continue_loop_on_deny).toBeUndefined();
   });
 });