feat!: drop opencode-claude-auth integration entirely (#117)

[chubes4]

Summary

Closes #117. wp-coding-agents no longer installs, patches, or references the third-party opencode-claude-auth plugin on any chat bridge.

• Kimaki bridges: AnthropicAuthPlugin shipped with Kimaki v0.6.0+ already handles OAuth (token refresh, multi-account rotation, request rewriting). The plugin entry was correctly skipped on these bridges since Support multi-account Anthropic OAuth across all chat bridge and runtime combos #51 — but upgrade.sh Phase 7 was still calling _install_opencode_wrapper unconditionally on every Kimaki VPS run, which replaced the npm-shipped opencode binary with a bash shim whose only job was to feed credentials into ~/.claude/.credentials.json for the plugin we no longer load. That's exactly what surfaced as the bug on the extrachill.com VPS in opencode loads kimaki-managed config only — project opencode.json::instructions never reaches LLM context #117.
• Non-Kimaki bridges: authenticate through opencode's native auth flow (opencode auth login anthropic). They never needed a third-party plugin either.

Changed

Removed

• runtimes/opencode.sh::_install_opencode_wrapper — the bash shim template + install logic
• runtimes/opencode.sh::_patch_claude_auth_plugin — the PascalCase patch invocation
• runtimes/opencode.sh OPENCODE_PLUGINS branch that emitted "opencode-claude-auth@latest" for non-kimaki bridges
• lib/patch-claude-auth.py (entire file)
• lib/repair-opencode-json.py expected_plugins() entry for opencode-claude-auth@latest
• upgrade.sh::reapply_claude_auth_patch
• tests/opencode-wrapper.sh (the test that pinned the install behavior)
• .github/workflows/shell.yml opencode-wrapper job

Added

• runtimes/opencode.sh::_remove_legacy_opencode_wrapper. Detects the wp-coding-agents-opencode-wrapper-v2 sentinel on the global opencode binary, restores a hardlink (or symlink) to the real .opencode binary, and cleans up matching .bak.* files. Idempotent and a no-op on installs that never had the wrapper.
• upgrade.sh::remove_legacy_opencode_wrapper_phase. Same Phase 7 slot, now exclusively dedicated to cleaning up after older upgrades. Existing kimaki VPS installs that grew the wrapper get repaired automatically on the next ./upgrade.sh run.
• tests/opencode-wrapper-removal.sh regression: legacy wrapper is cleanly removed, repo no longer ships any of the install machinery, non-wrapper binaries are never touched.
• .github/workflows/shell.yml opencode-wrapper-removal job.

Other

• Bumped VERSION to 0.9.0.
• Added [0.9.0] changelog entry under Removed / Added / Changed.
• Updated skills/upgrade-wp-coding-agents/SKILL.md description to match the new behavior (removes legacy wrapper, no longer references the PascalCase patch).
• Stripped out-of-date opencode-claude-auth@latest references from comments in upgrade.sh and lib/repair-opencode-json.py.

Validation

Ran on the workspace checkout (/var/lib/datamachine/workspace/wp-coding-agents):

• bash -n clean on upgrade.sh, runtimes/opencode.sh, tests/opencode-wrapper-removal.sh
• python3 -c "ast.parse(...)" clean on lib/repair-opencode-json.py
• tests/opencode-wrapper-removal.sh — 12/12 assertions pass
• tests/repair-opencode-json.sh — pass (existing regression, unaffected)
• tests/post-upgrade-restore.sh, tests/path-helpers.sh, tests/homeboy-components.sh, tests/kimaki-session-helper-smoke.sh — pass

tests/bridge-render.sh shows a pre-existing kimaki-launchd snapshot drift that reproduces against main without my changes — unrelated to this PR.

Breaking change

feat!: because any downstream relying on wp-coding-agents to install or patch opencode-claude-auth will lose that behavior. Such a configuration was never the supported path on Kimaki bridges, and non-kimaki bridges now expect users to run opencode auth login anthropic themselves.

Manual remediation parity

The PR's _remove_legacy_opencode_wrapper produces the same end state as the manual fix already applied to the extrachill.com VPS earlier today:

cd /usr/lib/node_modules/opencode-ai/bin
rm opencode opencode.bak.*
ln .opencode opencode

After this lands and a fresh ./upgrade.sh runs, every Kimaki VPS that grew the wrapper gets the same cleanup automatically.