fetch:opencode: build from local fork clone pinned by git ref

[jack-champagne]

The vendored opencode now builds from a local harmoniqs/opencode clone at a git ref pinned in opencode.lock.json, instead of trusting release binaries. This also fixes the bug that made the releases look broken: binaries built with the documented recipe hid every amicode UI surface (home cards, institution card, v2 titlebar) — see Channel gate below.

Lock (opencode.lock.json): source: "local" + ref = merged fork PR #1 head (ab0e798). repo/tag/platforms stay as the release fallback.

Fetcher (fetch_opencode.mjs):

• Clone resolution: --local <path> > AMICODE_OPENCODE_SRC > sibling ../opencode.
• Verifies clone HEAD == locked ref and tree is clean; --any-ref bypasses for iteration; --no-build reuses an existing artifact.
• Runs the fork's build with OPENCODE_VERSION=<v> and OPENCODE_CHANNEL=dev (see below), bun dir prepended to PATH.
• Stamps the actual binary sha256 + a .source provenance file (local <ref>[+dirty] / release <repo>@<tag>) — replaces the hand-swap workflow that left the stamp lying at the manifest value.
• No clone present → warns and falls back to the pinned release, so CI needs no changes. Explicit --local/--release force a mode.

Channel gate (the release bug): OPENCODE_VERSION=1.17.3 (per the fork's AMICODE-PATCHES.md §3 recipe) forces Script.channel=latest → the web-UI embed compiles with VITE_OPENCODE_CHANNEL="prod" (app/vite.js) → settings.general.newLayoutDesigns defaults off (settings.tsx:55) → home.tsx:142 renders LegacyHome: all amicode surfaces hidden at runtime despite being compiled in. Confirmed in the bytes: release amicode.2 and the old recipe both inline the gate as false; with OPENCODE_CHANNEL=dev it inlines true. Every smoke layer (boot, /event, --version, title) passes either way, which is why no gate caught it. Follow-up: fix the recipe in the fork's AMICODE-PATCHES.md.

Verified: 14/14 fetcher tests; full suite 430 pass + 1 pre-existing stale-VSIX packaging failure (fails on clean tree too); real end-to-end on linux-x64 — clone at ab0e798 → build → smoke 1.17.3 → test:smoke PASS → gate constant !0 in the vendored binary; homepage cards confirmed rendering in the live extension (Jack).

Base is rchari/workbench (the fork-release machinery + amicode.2 pin aren't on main yet).