feat(opencode): move OpenCode install and entrypoint into an agent kit

[mogul]

Intent

Move OpenCode-specific install/start ownership out of core acq behavior and into an OpenCode agent kit, following ADR-0030's agent-install contract.

Parent: #473
ADR: #474

Scope

• Provide an OpenCode agent kit with content-pinned installation.
• Prefer nix profile install github:NixOS/nixpkgs/<rev>#<agent> when OpenCode is available through the selected nixpkgs rev.
• Use a sha256-pinned release binary pattern if nixpkgs cannot supply the agent.
• Declare the OpenCode entrypoint in the agent kit.
• Remove or retire the unpinned npm install -g opencode-ai fallback as a contract path.
• Ensure any agent-populated image is treated as an artifact derived from applying the kit, not as behavior source-of-truth.

Deferred Decisions

• Exact image-building/caching automation can be deferred until after the kit path works from a generic devenv base.
• Provider config rendering is tracked separately.

Acceptance Criteria

• OpenCode can be installed from a generic devenv-enabled, agent-less base through the kit.
• The installed OpenCode version is content-pinned.
• Re-running create/run is idempotent.
• Current acq run opencode . UX remains stable through the migration.
• Tests or live verification cover a clean sandbox path without an OpenCode-populated base image.

Orchestration Notes

Implementation should be done by an authoring sub-agent and reviewed by an independent adversarial review sub-agent. Review findings must be addressed before the increment is accepted.

[mogul]

Implemented the quickstart-side validation/gating prep increment for the future OpenCode agent-kit cutover.

Commit: 9be74d3 feat(agent-kits): validate built-in agent artifacts

What landed:

• Added static validation for built-in agent-kit artifacts without executing kit code.
• Validation currently requires:
  • spec.yaml exists
  • schemaVersion: "hybrid/v1"
  • kind: mixin
  • top-level kit name matches the expected built-in kit name (opencode)
  • direct agent.name matches opencode
  • direct agent.entrypoint matches opencode
• Added acq_agent_builtin_kit_ready, combining the existing enable flag with artifact validation.
• Kept acq_agent_builtin_kit_enabled opencode false by default, so current behavior remains deferred until a real patterns-side artifact exists and the enablement policy changes.
• Added a small readiness cache so enabled validation does not repeatedly fetch/check the same ref during one invocation.
• Preserved explicit --kit suppression and shell no-agent-kit behavior.
• Did not alter the MSB npm fallback install path.

Review findings addressed before commit:

• Avoided repeated validation/fetches by caching readiness results per agent/ref.
• Fixed older enabled-path tests to use valid fixture artifacts.
• Tightened the agent: parser to direct child fields only.
• Added tests for wrong agent.name, wrong agent.entrypoint, and nested metadata that should not satisfy the contract.

Verification:

• PASS: ./test/vendor/bats-core/bin/bats test/bats/140-opencode-migration-gate.bats test/bats/85-kit-provenance.bats test/bats/50-kit-list-completeness.bats test/bats/30-dispatch-routing.bats (93/93)
• PASS: bash -n acq acq.backends/common.sh acq.backends/agents.sh acq.backends/kit-translate.sh
• PASS: focused ShellCheck on changed shell/test files
• PASS: git diff --check

Still deferred:

• Actually publishing/consuming the real patterns-side OpenCode agent kit.
• Flipping acq_agent_builtin_kit_enabled opencode on by default.
• Removing/demoting the current MSB npm fallback install path.