feat(opencode): add internal Cloudflare MCP

[xnoto]

Summary

Adds the existing, verified internal Cloudflare ToolHive remote proxy as the enabled cloudflare MCP consumer in opencode-server chart 0.1.71. OpenCode uses the in-cluster Streamable HTTP service with OAuth disabled; it receives no Cloudflare credential, static header, or OAuth client configuration.

Fixes # N/A

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test workflow run 34316976509 passed repository hygiene, Helm validation/rendering, changed-chart detection, and package opencode-server. It does not publish on a pull request or prove runtime MCP behavior.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; files/opencode.json is the canonical packaged ConfigMap input and the Deployment checksum rolls it on selection.

Pre-PR adversarial review found no Critical/High/Medium/Low defect. Infrastructure-security review found no Critical/High issue; it recorded the existing low residual risk that Cloudflare's generic execute capability relies on the dedicated token's read-only scope. QA records that PR CI validates chart structure/package only, not MCP reachability or OpenCode runtime behavior. Release review is ready with the owner-approved no-denied-write-test boundary carried into post-rollout verification.

Impact and rollout

• Producer changed: only opencode-server/Chart.yaml, files/opencode.json, and its README. The chart version changes 0.1.70 → 0.1.71; the image, templates, Secrets, proxy, ToolHive pin, DNS, TunnelBinding, and Cloudflare Access/OpenTofu ownership are unchanged.
• Consumer added: OpenCode gains mcp.cloudflare, targeting only the existing cluster-internal makeitwork-cloudflare-read proxy. The proxy was reconciled, healthy, and functionally verified through MCP initialization plus an authorized bounded read-only account-list request before this PR.
• Authorization boundary: no Cloudflare token enters the chart or OpenCode. The cluster-owned SOPS Secret remains the proxy's sole credential source. The proxy is non-aggregated and has no dedicated TunnelBinding route. Generic execute capability is bounded by the token's read-only scope, not the tool name; no denied-write probe was performed.
• Automatic after confirmed merge: Charts main packages and publishes immutable OCI chart 0.1.71, then existing automation creates or updates the kustomize-cluster automation/opencode-server-0.1.71 pin PR and enables its required-check-gated auto-merge.
• Manual post-merge gates: verify the OCI artifact name/version, generated GitOps diff/checks/merge, root and opencode Application revisions/health, OpenCode Deployment/pod rollout, and a fresh OpenCode session listing and using cloudflare for a bounded read-only request. No manual Argo sync is planned.
• Rollback: use a focused kustomize-cluster PR to return the OpenCode chart pin to immutable 0.1.70; leave the independently owned Cloudflare proxy unchanged.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, or tokens. The required in-cluster service URL is non-secret configuration.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change and review. User authorized configuration, merge/publication, and rollout. No Secret retrieval, Cloudflare write request, manual Argo sync, or live patch was performed.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.