Give OpenCode an attachable Stage 3 pr-reviewer recipe so its agent card exposes a Shell session

[atomantic]

Summary

• Stage 3 (sandboxed-actions) runs on an OpenCode-backed TUI provider now get a PTY and an "Open Shell" link instead of being forced headless with "No shell". The OPENCODE vendor row gains a sandboxed-actions recipe whose attachable argv is the bare opencode binary (its real interactive entry point) with --agent build pinned and -m namespaced by the same helper the headless argv uses; the spawner pastes the prompt as it does for every other TUI. Matches any spawnable OpenCode binary (MTPLX and gateway backends included), unlike the Ollama-only no-tool gate.
• Headless OpenCode actions runs are unchanged — still the ordinary opencode run … argv with provider args forwarded.
• Recipes now declare spawnArgs (headless) and/or tuiSpawnArgs (attachable) instead of tui: true / an enforces flag. Attachable = supplies tuiSpawnArgs; enforced (OS-sandboxed, as the schedule UI reports it) = supplies spawnArgs. OpenCode's actions row supplies only the attachable builder, so it stays worktree-only in the UI and out of the "install one of these" suggestion structurally. Claude's row is unchanged in behavior.
• OPENCODE_BUILD_AGENT joins OPENCODE_PUBLIC_REVIEW_AGENT in providerModels.js; opencodeConfig.js uses it instead of a bare literal.
• No client change: AgentCard.jsx's noShellReason already keys off executionMode/tuiSessionId.

Verified empirically under node-pty in a scratch worktree with the exact env buildCliChildEnv composes for the actions profile against a local Ollama backend: the bare invocation boots, the bracketed-paste prompt renders ([Pasted ~1 lines] chip), Enter submits it, and the build agent completed a write tool call and answered.

Note for reviewers: for a gateway-backed OpenCode wrapper OPENCODE_CONFIG_CONTENT is stripped by the actions env allowlist and the child runs on the operator's own ~/.config/opencode — pre-existing headless behavior, now called out in the recipe's doc comment rather than changed here.

Test plan

• server/lib/providerVendors.publicReview.test.js — opencode-tui asserted attachable (every backend) with the bare-binary argv, headless argv pinned unchanged, no-tool posture still Ollama-only, enforced-posture list still excludes OpenCode's actions stage
• server/services/agentLifecycle.postureGate.test.js — a Stage 3 task on an OpenCode TUI provider reaches spawnTuiAgent with the actions profile
• Affected server suites green: providerVendors*, providerModels, opencodeConfig, agentTuiSpawning, tuiHandshake, cliChildEnv, publicReviewProviderSelection, routes/providers, agentErrorAnalysis, agentPromptBuilder, importScoping, lib/index
• Client: PipelineStageConfig, AIProviders, utils/providers green

Closes #6238

[atomantic]

Required code review was not completed before publication. This PR is intentionally left open and will not be merged until the required review completes.

[atomantic]

Blocked reviewer: codex (usage limit exhausted; resets 2026-09-07). The claude local review returned APPROVE with one non-blocking doc note, already addressed in the last commit. To finish: rerun the codex review against this branch, then merge.