OpenCode harness: add kernel-level sandbox isolation

[terraboops]

Problem

The OpenCode harness currently translates AgentConfig.sandbox into OpenCode's per-tool permission system (edit: "deny", bash: "deny" for read-only profiles). This is application-level enforcement only — it relies on OpenCode respecting its own permission flags, not OS kernel restrictions.

The other two harnesses have kernel-level isolation:

• ChibiHarness → nono (Landlock on Linux, Seatbelt on macOS)
• ClaudeCodeHarness → SDK sandbox (Seatbelt on macOS, bubblewrap on Linux)

Desired Behavior

When AgentConfig.sandbox is set, the OpenCode harness should enforce file access restrictions at the kernel level, matching the protection guarantees of the other harnesses.

Options to Explore

1. Wrap the opencode server process with nono — similar to how ChibiHarness wraps chibi-json. Would require passing readPaths/writePaths through to nono args when spawning the server.
2. Use OpenCode's sandbox worktrees — the SDK has a sandboxes API (v2/gen/types.gen.d.ts). Worth investigating whether this provides file isolation.
3. Contribute upstream — if OpenCode doesn't support kernel sandboxing, consider contributing Seatbelt/bubblewrap support to the OpenCode project.

Current State

Application-level permission enforcement was added in the terra/docs-sandbox-capabilities branch. See src/harness/opencode-harness.ts and docs/security-model.md for details.

References

• src/harness/opencode-harness.ts — current permission-based sandbox
• src/harness/sandbox.ts — nono wrapper (reference implementation)
• docs/security-model.md — documents the gap