feat(ci): call shared OpenCode runner

[xnoto]

Summary

Adds a comment-triggered, thin OpenCode workflow caller. It forwards the chart's canonical agent and skill path plus the Kimi credential to the immutable reusable runner in makeitworkcloud/shared-workflows#40.

Fixes # — not applicable

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test and detect passed; package and post-publish GitOps jobs were correctly skipped because no chart content changed
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed

Impact and rollout

Consumer: makeitworkcloud/charts owns only the /oc and /opencode event filter, caller permissions, and reference to reusable runner commit 73444d2177762549d8c476dc612f23811e0a2180. The reusable runner, its CI-specific configuration, pinned runtime installation, and runner guardrails are owned by makeitworkcloud/shared-workflows in PR #40.

Merge shared-workflows#40 before this PR. The caller stages opencode-server/files/{agents,skills} through the reusable workflow but does not package runner files into the Helm chart, change Chart.yaml, publish an OCI artifact, or modify GitOps desired state.

The workflow needs a KIMI_API_KEY Actions secret for functional use. Current tfroot-github source does not distribute that secret to charts; adding its encrypted value and recipient is a separate confirmation- and OpenTofu-gated change, intentionally not included here.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — no chart release or deployment occurs; reverting this caller disables adoption

AI agent materially produced this change. Knowledge source revision consulted: 25417c8d85ca246f7afb570630bf4ca463401999.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.