feat: support OpenCode CLI through ACP

[EmersonBraun]

Parent

#37

What to build

Add the first-class opencode-cli provider using OpenCode's ACP stdio mode (opencode acp). The adapter must behave as one bounded worker for one review lens and translate a valid schemaVersion: 1 JSON response into the existing AgentsKit tool-call stream.

Acceptance criteria

• --provider opencode-cli resolves through the provider registry and remains distinct from all API provider IDs.
• ACP initialize/session/prompt/update/shutdown lifecycle is implemented with bounded timeouts and cancellation.
• The adapter requests one lens result and never delegates lens selection, verification, consolidation, or reporting to OpenCode.
• The adapter accepts only the versioned JSON envelope and validates the expected Finding schema before emitting a tool call.
• One bounded retry is allowed only for empty/malformed/schema-invalid output.
• Filesystem write, terminal, MCP, plugin, and subagent capabilities are not granted in isolated mode.
• trusted-local may reuse the user's OpenCode configuration but remains a worker-only review path and cannot write the real checkout.
• Provider/model/endpoint data boundary and effective version appear in diagnostics without secrets.
• Offline ACP fixtures cover successful output, malformed output, timeout, cancellation, permission request, tool-attempt rejection, and process failure.
• The provider is not marked stable until all offline contract tests pass.

Blocked by

• Blocked by feat: add versioned provider registry and doctor #38 for provider registry and doctor.
• Blocked by feat: add versioned review configuration and lens policy #39 for config/trust policy.
• Blocked by feat: harden the bounded local CLI worker #40 for bounded CLI lifecycle.

Files and references

• src/opencode-cli-adapter.ts (new)
• src/local-cli-process.ts
• test/fixtures/bin/ or a dedicated ACP fixture
• test/cli-smoke.test.mjs
• OpenCode CLI documentation
• OpenCode ACP documentation
• ADR-0001

Notes

Do not install OpenCode automatically. The Action must fail early with a doctor-style message when the executable is absent.