fix(opencode-sms-bridge): select error-envelope image

[xnoto]

Summary

Select ghcr.io/makeitworkcloud/opencode-sms-bridge:e9130e6ac0a4eb4bb7c47bea79807b873ce5a9cc, the immutable image published after images PR #42. It distinguishes a structurally valid OpenCode V1 error envelope from malformed or textless non-error responses with the static PII-safe code opencode-response-error.

Verified producer evidence: images buildah run 33977700201 passed checks, detected opencode-sms-bridge, built it, and completed registry push for this immutable tag.

This PR changes only the bridge image tag. It changes no chart version, route, routing/allowlist, Secret, Service, TunnelBinding, provider/model configuration, or Argo sync policy.

Fixes #

None — owner-authorized diagnostic rollout; no driving issue supplied.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor /cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending. Repository PR CI is the validation authority.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none apply; this is a one-line immutable image-pin change.

No local OpenTofu, SOPS, container build, cluster, or live-system operation was run or claimed.

Impact and rollout

Producer: images merged e9130e6…; its post-merge build and registry push succeeded.

Consumer: workloads/apps/opencode-sms-bridge-app.yaml is the canonical GitOps image-selection point. This PR proposes selection only.

Delivery stages: source is merged, published, and producer-validated; GitOps selection is proposed and PR validation is pending. An authorized merge runs test on main; only a successful test triggers automatic root-sync submission. Root and child reconciliation, resource health, and another approved-source SMS test remain separate verification stages.

Behavior boundary: this rollout improves safe error classification only. It does not claim to resolve the underlying provider-side failure that produced the prior no-text error turn.

Rollback: use a reviewed GitOps PR to restore the prior immutable tag adb1e0e72729a7182b4a4929bd67e0275fba8173; do not retag images or patch live resources.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change: an OpenCode agent materially produced this change; review the producer evidence, one-line diff, and automatic post-merge reconciliation behavior before merge.