feat(opencode): add managed runtime, provider auth, and model configuration

[richardfogaca]

Linked issue

None.

Summary

• Add OpenCode as a managed executor runtime with bounded startup, admission, and credential isolation.
• Add provider API-key and OAuth authentication using OpenCode's native credential storage.
• Add a caller-scoped provider/model catalog and require an exact pair for runnable OpenCode configurations.
• Carry preset, workspace, personal-default, schedule, gateway, fork, and spawn configuration through one reference-or-inline contract.
• Add provider/model selection across session surfaces, polish provider credential actions, and use OpenCode consistently without beta labeling.

Why / context

OpenCode needs a managed runtime, provider authentication, and an explicit provider/model pair before Agor can execute it reliably. This PR delivers that complete path in one change set: Agor manages the runtime boundary, delegates credentials to OpenCode, resolves configuration through the existing precedence model, validates selections before provider activity, and keeps stale or unavailable selections visible instead of silently replacing them.

Implementation notes

• Adds managed OpenCode runtime lifecycle and executor admission with branch/user credential namespacing.
• Adds bounded opencode-auth and opencode-models services scoped to the authenticated execution owner and authorized branch.
• Supports native API-key and OAuth provider flows without introducing a competing credential registry.
• Centralizes reference resolution and materialization across sessions, schedules, gateways, presets, and child-session flows.
• Enforces reference-versus-inline payload shapes and rejects missing or partial OpenCode pairs before execution.
• Targets main directly; the runtime, provider-authentication, and provider-model changes are all included in this PR.

Validation / test plan

• Full UI suite: 177 test files, 1,189 tests passed.
• Focused OpenCode runtime, provider-authentication, provider-settings, and model-selector coverage passed.
• Full UI typecheck passed at the implementation fixed point; later changes were limited to labels, layout, documentation, and test expectations.
• Exact-source browser inspection covered provider discovery, selection, credential controls, and action layout.
• Fresh standards/spec review completed against the final provider-model diff with no unresolved findings.

Risks / rollout / rollback

• Provider authentication and model discovery depend on the managed OpenCode runtime and the caller's available provider state; failures remain bounded and actionable.
• Credential persistence remains owned by OpenCode and is isolated by the existing execution-owner namespace.
• No schema migration or deployment configuration change is included.
• Rollback is a normal revert of this PR.

Out of scope / follow-ups

• No automatic OpenCode provider/model fallback is introduced.
• Existing historical documentation screenshots are unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.