feat(opencode): use native session supervision

[aksOps]

Summary

• replace the generated OpenCode .mjs identity plugin with native authenticated serve and attach supervision
• require OpenCode 1.18.1 or newer and preserve exact provider-session resume behavior
• track /new session identities, permission events, reconnect gaps, startup deadlines, and provider exits safely
• harden provider identity files, relative runtime directories, process cleanup, and foreground PTY behavior
• add end-to-end, race, security, lifecycle, compatibility, and deep Unix-socket-path regression coverage

Why

The generated plugin was brittle across OpenCode versions and could lose or reuse the wrong provider session identity. Native OpenCode APIs provide a supported identity and event path without generated JavaScript.

Compatibility

• existing CLI flags and JSON output remain unchanged
• default yolo behavior remains unchanged
• non-OpenCode providers remain unchanged
• relative runtime directories and short Unix socket paths remain supported
• no store schema migration is introduced

Verification

• full go test -race -count=1 -covermode=atomic -coverpkg=./... ./...
• 88.6% aggregate coverage, above the 88.1% floor
• go vet, golangci-lint, staticcheck, gosec, and govulncheck
• go mod verify, formatting, and diff checks
• Linux and Darwin, amd64 and arm64 compile-only matrices
• independent final review approved with no Critical or Important findings