fix: resolve relative extra paths from config root

[iHildy]

Summary

• resolve relative extraConfigPaths and extraSecretPaths from $XDG_CONFIG_HOME/opencode instead of the process working directory
• preserve existing ~/ and absolute-path behavior with platform-specific path semantics
• keep manifest allowlists exact and repository payload paths contained
• cover config and secret files/directories, unrelated working directories, Windows behavior, default-item deduplication, and traversal
• integrate current main, including override stripping (fix: strip overrides removes keys missing from local config #50), canonical plural config directories (fix: sync plural OpenCode config directories #71), and explicit non-GitHub remotes (feat: support explicit non-GitHub Git remotes #73)

Verification

• bun run check
• bun test (110 tests, 245 assertions)
• bun run build
• unrelated-CWD two-home exercise passed for config and secret files/directories under independent machine A/B XDG config roots; repository paths stayed contained and machine B replaced all four payloads
• full isolated GitHub E2E passed: machine A init and two pushes, machine B link and pull, active tree unchanged, and ephemeral repository deleted

The full harness emitted its known local-materialization warning: machine B live AGENTS.md did not refresh after the final pull, while its isolated sync clone contained the second sentinel, confirming repository replication. Loopback servers also emitted the expected unsecured-server warning in the isolated sandbox.

Scope

Portable extra-path manifests remain separate from this fix; this change keeps the existing absolute manifest source-path format.

Closes #43