feat(opencode): prefer direct agent-knowledge commits

[xnoto]

Summary

Aligns all nine primary OpenCode prompts with makeitworkcloud/agent-knowledge governance. Named agents with an authorized docs/agents/<agent>/ subtree now prefer one scoped, descriptive GitHub commit directly to main for verified, non-sensitive knowledge updates. They do not open a branch, pull request, or merge operation for that scoped exception.

The generic default agent remains read-only for knowledge maintenance because it has no autonomous knowledge subtree. Pull requests remain the path for owner-requested review and changes outside an agent's own subtree. The homesteader exception retains private-access and owner-confirmed-fact safeguards.

Fixes #

None — owner-approved agent-knowledge governance alignment.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test run 33976339312 passed repository hygiene and Helm validation.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed.
• Manual review: all nine primary-agent definitions retain self-contained policy; the chart architecture document now defines the narrow direct-main exception; the generic default agent remains outside the exception.

No local Helm, OpenTofu, Kubernetes, or live-system operation was run or claimed. CI is the validation authority.

Impact and rollout

Producer: this change updates immutable opencode-server package inputs and bumps the chart version from 0.1.65 to 0.1.66.

Consumer: the OpenCode Deployment receives the updated primary-agent prompts only after chart publication and a separate GitOps version pin. Subagent definitions, providers, MCP endpoints, Kubernetes resources, and secrets are unchanged.

Delivery stages: this PR authors and validates chart content. After an explicitly approved merge, main may publish the immutable chart and automatically open or update the separate kustomize-cluster version-pin PR. That desired-state update, Argo CD reconciliation, workload health, and representative agent behavior require separate verification.

Rollback: select the prior immutable chart version through a reviewed GitOps change; never patch the running ConfigMap or Deployment.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; changed content was manually reviewed. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the direct-main scope, default-agent authority boundary, homesteader safeguards, and chart-version bump before merging.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.