feat(opencode): push native turn-diff evidence to Review (#1625)

[chuks-qua]

What

OpenCode now pushes native turn-diff evidence to Review. The provider consumes upstream session.diff SSE events, validates each entry (safe path, full-context single-hunk patch, per-file and aggregate size bounds), reconstructs exact before/after contents, normalizes them into the canonical text patch, and emits provider-neutral ProviderTurnDiffUpdate events carrying turnId, turnExecutionId, deliveryAttempt, and a monotonic revision. Malformed evidence rejects the whole aggregate and stays rejected; a net-zero turn emits indeterminate-empty so Review falls back honestly. turn-diff is now advertised in OpenCode's capabilities, and OpenCode runs the shared provider-neutral conformance suite.

Review's Last turn header again labels the evidence source: Agent changes for native evidence, Tracked file evidence for tracked snapshots, and Git fallback: same-file edits may appear for the git fallback, exposed via data-review-source / data-review-fidelity.

Also included: a separate commit fixing the verify-mcode watcher proof, which rejected legitimate unrelated files.changed broadcasts and expected workspace-relative paths where file.refresh reports git-root-relative paths for fixture directories inside a parent repo.

Why

Reviewers need to see exactly what the agent changed. Git-snapshot diffs can conflate external edits made to the same file; OpenCode's native session.diff evidence is agent-attributed. Native evidence also powers the mid-turn Live view. Part of #1621. Closes #1625.

UI Changes

Video (plays in browser via blob view): https://github.com/Mzeey-Empire/mcode/blob/pr-assets-1625/.dev/pr-assets/review-1625-labels.mp4 — searching for a thread, opening Review, Last turn view rendering the Agent changes label over the agent-attributed patch.

Config Changes

None.

Verification

• bun run --cwd packages/providers test -- opencode-native-turn-diff.test.ts turn-diff-conformance.test.ts: 23 tests pass (accumulator safety: unsafe paths, missing/non-string/oversized/partial/multi-hunk patches, sticky rejection, same-file replacement, added/deleted files, indeterminate-empty, conformance suite).
• bun run --cwd apps/server test -- opencode-provider-turn-diff.test.ts turn-diff-review.test.ts turn-diff-service.test.ts: 32 tests pass (event ownership, foreign-session filtering, capability declaration, settlement and fallback semantics).
• tsc --noEmit clean in packages/providers, apps/server, apps/web; lint clean on touched scopes.
• Live UI capture (video): a native turn-diff record resolved through the real turnDiff.getComparison RPC renders the Agent changes label and the agent patch in Electron-served Review UI.

Review Notes

Environment coverage gaps, stated plainly: the opencode CLI is not installed on this machine, so no live OpenCode turn was driven end to end; the UI video drives the real Review RPC path against a seeded native snapshot rather than a live OpenCode session. Native Codex evidence also does not reach this environment (upstream/session-eviction gap unrelated to this change), so the settled-native path is demonstrated by test coverage plus the seeded RPC read. The watcher-proof fix is a separate commit on this branch.

Assets note: this gh build has no --attach support, so the screenshot and video are pushed on pr-assets-1625 and linked above; delete that branch after merge.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}