fix(deploy): protect host config

[shuv1337]

Summary

• designate ~/.config/shuvcode/opencode.json as the canonical Shuvcode preferences file
• retain ~/.config/opencode for required XDG compatibility, service registration, and state
• require the compatibility preferences path to symlink to the Shuvcode file
• add a guarded host installer that proves the preferences target and hash are unchanged
• add a non-mutating deploy preflight mode

Root cause

The shared-service migration repointed the compatibility preferences path at an older V1-shaped dotfiles config. Later binary restarts reloaded that wrong source, making deployment appear to overwrite newer preferences.

Validation

• bash -n deploy/install-host.sh
• shellcheck deploy/install-host.sh, when available
• invalid-argument behavior check
• git diff --check
• pre-push monorepo typecheck: 32/32
• live shuvdev symlink and config hash verification
• live Build agent and OAuth/plugin verification