Chore: bump fork pin to v1.18.10-amicode.21 — repair main's app-bundle-gate red

[aarontrowbridge]

Important

Problem

Main's app-bundle-gate has been red since #765 merged: the session-review overlay file was hand-edited to mirror the fork's refresh button (#744) instead of bumping the fork pin, and the drift gate correctly flagged the divergence (overlay file hash mismatch (hand-edit?)).

Approach

Move the pin to v1.18.10-amicode.21 — the fork tag that officially contains #744's refresh button — regenerate the overlay + manifest via the extractor, and bump the vendored-binary lock via the sanctioned pin flow. Aaron-approved 2026-09-03 (chose .21 over .22 to skip the in-progress chat restyling).

Approaches Considered

• Pin .21 (chosen) — refresh button + watcher ungate + two session fixes via the honest channel; skips .22's chat restyling (deliberate WIP).
• Pin .22 — full parity but ships yellow-bubble/prose/dot-rail work early.
• Revert fix: Files Changed cross-session contamination + external-change reactivity #765's overlay edit — green but loses the merged feature until a later pin.

Scope

In: opencode.lock.json bump to .21; app-bundle manifest fork_tag/fork_sha bump; overlay regeneration from the .21 extraction; drift-gate verification.
Out: any other product change; #775/#776.

---

Acceptance Criteria

1. drift_gate.mjs exits 0 locally against the fork clone (all three checks, fork present).
2. CI app-bundle-gate passes on this PR; main returns green after merge.
3. The refresh button (Slice 3: Refresh button — icon + panel toolbar control #744) is present in the regenerated overlay.
4. Full extension suite passes with the .21 vendored binary fetched.

Source

• Forensics: vault sessions/session-20260903-handoff-bundle-dev.md (baseline-repair slice)
• Related: fix: Files Changed cross-session contamination + external-change reactivity #765 (the hand-edit), ops hardening: swap must archive the outgoing binary; refuse non-release candidates; smoke needs a soak; finish fleet-status systemd port on erlich #776 (release-channel parity ask)