feat(opencode): use generic devenv base by default

[mogul]

Context

Implements ADR-0030 for the default acq run opencode . path. Both MSB and SBX now use the pinned generic devenv base instead of an OpenCode-specific image or SBX native OpenCode template.

Plan

• Select ghcr.io/gsa-tts/agentic-coding-patterns/devenv-shell@sha256:7b923fb5e722ad27c751ead836f24145c4cea3fac015a3ba753bd7473891e1e7 only for the default OpenCode path.
• Preserve image precedence: ACQ_MSB_IMAGE > --image > ACQ_IMAGE for MSB; explicit SBX --template remains authoritative.
• Require and validate the inferred pinned OpenCode kit before generic-default provisioning, including when users add --kit.
• Use shell only as SBX's template-selection token for the generic default, preventing SBX from synthesizing a duplicate native opencode kit. acq retains OpenCode as the logical agent for provenance, required-kit selection, and attach behavior.
• Launch SBX generic-default attaches through the kit-declared opencode entrypoint; retain explicit -- CMD escapes and project activation wrapping.
• Remove the unpinned opencode-ai postinstall fallback from the generic default path and update ADR-0030, backend, and failure-mode documentation.

Verification

• bash -n acq acq.backends/agents.sh acq.backends/common.sh acq.backends/msb.sh acq.backends/sbx.sh scripts/verify-backends passed.
• Focused Bats passed for image, migration, and SBX startup coverage.
• Full offline suite passed: ACQ_BATS_JOBS=1 ./scripts/test-acq-bats (740 tests).
• ShellCheck batch passed.
• npm run check passed, including pre-commit, ShellCheck, offline Bats, and executable-bit checks.
• git diff --check passed.

Live Validation Gap

A macOS SBX live run found that SBX synthesizes a native opencode kit from the positional agent token even with the generic template, causing a duplicate kit-name failure. Commit ea93761 fixes this and adds an explicit verifier assertion. Re-run the following on sandbox-capable hosts before readiness:

RUN_ACQ=1 scripts/verify-backends --only sbx
RUN_ACQ=1 scripts/verify-backends --only msb

Rollback

Revert commits ea93761 and b147788 to restore the former default image/template behavior. Existing sandboxes are unchanged; newly created default OpenCode sandboxes can be removed and recreated after rollback.

Security Impact

The default uses an immutable multi-architecture digest and a pinned, metadata-validated agent kit. The generic path fails closed when the required kit is unavailable or malformed, does not permit CLI kits to suppress it, and removes the default unpinned npm postinstall fallback. No authentication, authorization, secret handling, or egress policy is broadened.

AI Disclosure

AI-assisted implementation by OpenCode [gpt-5.6-terra]. Human review is required before deployment.

This PR remains draft pending human review and required live backend validation.

[mogul]

Updated draft PR with ea93761 to address the macOS SBX live failure.

SBX synthesizes a native agent kit from its positional agent token even when --template is provided. The generic-default branch now passes shell only to SBX selection while preserving logical opencode provenance, the explicit pinned OpenCode kit, and the kit entrypoint attachment path.

Verification: focused SBX/image/migration Bats, full serial offline Bats (740 tests), ShellCheck, npm run check, syntax checks, and git diff --check pass.

Live follow-up requested: RUN_ACQ=1 scripts/verify-backends --only sbx on the macOS SBX-capable host; the verifier now asserts that the create command uses the generic template with the neutral shell token to prevent the duplicate-native-kit regression. PR remains draft.

[mogul]

Updated draft PR with 67e596e. Generic-default SBX re-attach now treats option-led post-separator arguments as OpenCode arguments, so acq run NAME -- --version executes opencode --version; command-led escapes such as -- sh -c ... remain direct commands.

Verification passed: focused migration/SBX Bats, full serial offline Bats (740 tests), ShellCheck, npm run check, syntax checks, and git diff --check.

Live follow-up: rerun RUN_ACQ=1 scripts/verify-backends --only sbx on the macOS SBX-capable host. PR remains draft.