chore(opencode): upgrade OpenCode to 1.18.29

[xnoto]

Summary

Upgrades opencode-server from OpenCode 1.18.23 to 1.18.29 and pins the verified multi-architecture OCI digest. This upstream release fixes the ChatGPT OAuth model filter for integer-versioned GPT model IDs, enabling Astra discovery where the authenticated OpenAI account permits it.

Fixes # N/A

Type of change

• Container image
• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — workflow run 210: repository hygiene, Helm validation, changed-chart detection, and package opencode-server
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited (not applicable; no generated files changed)

No local validation was run or claimed.

Pre-PR review: adversarial and infrastructure-security reviews found no Critical or High defects. QA identified the expected boundary that Helm CI cannot validate upstream OAuth entitlement or live Astra behavior; this must be checked after the approved deployment rollout.

Impact and rollout

• Producer changed: opencode-server chart 0.1.69 will package the digest-pinned ghcr.io/anomalyco/opencode:1.18.29 image.
• Unchanged: chart templates, packaged OpenCode configuration, provider/secret wiring, agents, skills, and cluster-owned resources.
• Automatic after confirmed merge: the main workflow publishes the immutable chart and opens or updates the scoped kustomize-cluster version-pin PR for targetRevision: 0.1.69.
• Separate gates: GitOps PR checks/auto-merge, Argo CD reconciliation, workload health, and an authenticated OpenCode model-picker/request verification remain outstanding. The latter must confirm that the target OpenAI account can select GPT-6 Astra.
• Rollback: select the prior immutable chart version 0.1.68 through the canonical GitOps Application after appropriate review.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change and reviews; no deployment, synchronization, publication, or merge has been performed.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.