fix(opencode): allow bounded live-system diagnostics

[xnoto]

Summary

Allows OpenCode agents to retrieve, print, and summarize raw live-system output for authorized diagnostic work. The packaged policy now requires a bounded source, fields, and time range to reasonably exclude protected material; it retains the prohibition on credentials, decrypted secrets, auth material, private keys, kubeconfigs, OpenTofu state, and sensitive plans. It also prohibits printing, summarizing, attaching, committing, or persisting unexpectedly returned protected material.

The chart version is bumped from 0.1.72 to 0.1.73, and the chart README documents the runtime diagnostic boundary.

Fixes N/A — owner-requested correction to the packaged OpenCode policy.

Type of change

• Bug fix
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — workflow run 34326717926: repository hygiene and Helm validation (test), changed-chart detection, and opencode-server packaging all passed.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated copy exists; the ConfigMap renders files/AGENTS.md directly.

Impact and rollout

Producer: opencode-server/files/AGENTS.md; consumer: the chart ConfigMap and resulting OpenCode runtime configuration. The immutable chart version bump is included.

After an explicitly confirmed merge, the main workflow will publish the 0.1.73 OCI chart and automatically create or update the separate kustomize-cluster version-pin PR. That desired-state PR, its merge, Argo CD reconciliation, rollout health, and functional verification are unchanged and not completed by this PR.

Rollback before merge: close this PR. After any future selection, select a prior chart version through the canonical GitOps owner and verify reconciliation separately.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change; independent adversarial, QA, release, and infrastructure-security reviews completed. The infrastructure-security reviewer’s High finding on unbounded diagnostic retrieval was resolved before this PR.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.