Compiler must pass --enable-opencode to AWF when engine=opencode

[lpcox]

Problem

PR github/gh-aw-firewall#2337 gates the OpenCode API proxy listener (port 10004) behind an explicit --enable-opencode CLI flag. Previously, the listener started unconditionally whenever any credential was present (OPENAI_API_KEY, ANTHROPIC_API_KEY, or COPILOT_AUTH_TOKEN).

After this change lands, OpenCode workflows compiled by gh-aw will silently lose access to port 10004 because the compiler does not currently emit --enable-opencode.

Current Behavior

• BuildAWFArgs() in pkg/workflow/awf_helpers.go does not emit --enable-opencode
• The OpenCode engine routes through an existing backend port (10000–10003) via UniversalLLMConsumerEngine, but port 10004 (OpenCode's unified dynamic-routing endpoint) will no longer start

Expected Behavior

When config.EngineName == "opencode", the compiler should:

1. Add --enable-opencode to AWF args in BuildAWFArgs()
2. Add port 10004 to --allow-host-ports so the agent container can reach the OpenCode listener
3. Gate behind a minimum AWF version (the firewall version that ships PR Fix commit-title-prefix being stripped by git am #2337) — skip the flag for older pinned versions

Implementation Notes

• The flag is a CLI flag to the awf binary (not part of the config file schema)
• AWF internally maps it to AWF_ENABLE_OPENCODE=true env var in the api-proxy container
• --enable-opencode requires --enable-api-proxy (which gh-aw already enables via the config file's apiProxy.enabled: true)
• Port 10004 is used for OpenCode's dynamic provider routing (separate from per-engine ports 10000–10003)
• Follow the pattern used by --difc-proxy-host (gated on awfSupportsCliProxy) or --allow-host-ports (gated on awfSupportsAllowHostPorts)

Files to Modify

• pkg/workflow/awf_helpers.go — Add --enable-opencode in BuildAWFArgs() when engine is opencode
• pkg/workflow/awf_helpers.go — Include port 10004 in --allow-host-ports for opencode
• pkg/constants/ — Add AWFEnableOpenCodeMinVersion constant
• pkg/workflow/awf_helpers_test.go — Test the new flag emission
• pkg/workflow/enable_api_proxy_test.go — Add OpenCode to the proxy enablement tests

Depends On

• github/gh-aw-firewall#2337 (must be merged and released first)