refactor(msb): remove native opencode fallback

[mogul]

Summary

Draft top layer stacked above #545.

This removes quickstart's msb-native opencode installation fallback and enables the built-in opencode agent kit path by default. The msb adapter no longer:

• declares ACQ_MSB_OPENCODE_PKG or ACQ_MSB_NPM_HOSTS
• adds an adapter-owned npm registry allow-rule for agent installation
• runs npm install -g opencode-ai during provision
• carries npm-install failure disambiguation code for that removed path

Tests and docs now assert that opencode is supplied by the selected agent kit or the base image, not by a compatibility fallback.

Blocker

This PR is intentionally draft while the stack below still uses patterns-release-shaplaceholder from #545. Before this can be marked ready:

1. Replace the placeholder in the lower PR with the real GSA-TTS/agentic-coding-patterns release SHA.
2. Rebase this branch onto the updated placeholder-pin branch.
3. Rerun offline and live backend verification.

Live end-to-end verification could not prove the real agent-kit fetch/install path in this environment because neither sbx nor msb is installed.

Verification

• bash -n acq acq.backends/*.sh scripts/test-acq-lib.sh scripts/test-acq-bats scripts/fix-exec-bits test/bats/helper.bash scripts/verify-backends passed.
• printf '%s\n' acq acq.backends/*.sh scripts/test-acq-lib.sh scripts/test-acq-bats test/bats/*.bats test/bats/helper.bash | xargs -r -n8 shellcheck --severity=warning passed.
• npm run lint:md passed.
• ./scripts/fix-exec-bits --check passed.
• git diff --check passed.
• Focused Bats passed: ./scripts/test-acq-bats test/bats/30-dispatch-routing.bats test/bats/36-agent-catalog.bats test/bats/50-kit-list-completeness.bats test/bats/72-msb-agent-user.bats test/bats/90-sbx-startup-kit.bats test/bats/95-kit-ref-persistence.bats test/bats/140-opencode-migration-gate.bats (157 tests).
• Full offline Bats passed: ./scripts/test-acq-bats. The real-sbx grammar checks skipped because sbx is not on PATH.
• Live verifier: ./scripts/verify-backends completed with passed: 0 failed: 0 skipped: 2 warnings: 0; both sbx and msb were skipped because neither backend is installed.

Rollback

Revert commit c9d0ea2. If the lower placeholder PR has also landed, revert or replace the placeholder pin separately.

Security Impact

This removes an adapter-owned package-install path and its npm egress rule. Agent-install egress now belongs to the selected agent kit's declarations or to the base image contract. No secrets are added; tests continue to assert no secret value leakage.

[mogul]

Landed on main via the collapsed stack: #474 plus corrective #549, released in v4.0.0. This branch is now absorbed and is being deleted.