feat(providers): honor resolved dispatch modes for opencode

[chuks-qua]

What

Closes #1626.

Implements the OpenCode slice of #1626. Every dispatched OpenCode turn now carries and honors its resolved modes. OpenCodeProvider implements getApprovalReviewSupport and honestly reports unavailable, since the upstream serve API exposes per-tool permission asks but no native turn-review verdict. Full Access turns auto-answer upstream permission asks with always through the existing relayDecision path instead of surfacing a card; question asks still card because they are interactive input, not permission gates. Supervised behavior is unchanged. The adapter is also registered in the shared provider conformance suite with a boundary factory, boundary id, and a core synthetic fixture.

Why

#1626 wires the provider-neutral review seam (#1614/#1615) into OpenCode as the second adapter. Resolved permissionMode and approvalReviewMode already reach sendTurn top-level; the adapter previously ignored them. Because OpenCode has no native reviewer, the approval-review capability stays undeclared so the Composer never offers Auto for it, and the policy records the real reason instead of the generic no-method fallback.

Review Notes

What this PR does not cover, and why:

• The "automatic with support present → reviewing → approved/denied" journey stays dormant. OpenCode's serve API has no turn-review primitive, so getApprovalReviewSupport can only honestly return unavailable. A client-side synthesized review (second session + verdict parsing) was rejected because it would fabricate a lifecycle Enforce automatic-review fallback and permission safety #1615 forbids, and a denied verdict would have no enforcement hook. If upstream ships the auto-approve classifier work, getApprovalReviewSupport is the single place to flip.
• Managed-required blocking is unreachable for OpenCode. The required status comes from the provider's own inspection, and no upstream signal exists to produce it. Dispatch still resolves to manual with the recorded reason.
• The conformance registration proves the factory and core-lifecycle seam. There is no approval-review fixture profile because there is no review behavior to replay.
• Full Access auto-approval is adapter-side rather than a serve config change because the pooled server is shared across threads in a worktree and a config write would leak between them.
• Version evidence in the conformance registration names the serve request generations (legacy/v2) the adapter speaks; no upstream semver is pinned in the repo.
• Verified: 102/102 opencode adapter tests including 5 new behavior tests, 27/27 conformance and factories tests, 431/431 contracts tests, tsc --noEmit and oxlint clean across all touched packages, verify-mcode runtime check provider and contract phases green. Live OpenCode proof is a coverage gap: the opencode CLI is not installed in this environment.