refactor(opencode): make primary policies agent-local

[xnoto]

Summary

Moves repository, routing, delegation, evidence, pull-request, and delivery rules from the long shared OpenCode prompt into direct primary-agent definitions. Adds a generic selectable default primary-agent template, keeps the universal safety floor short for subagents, gives repository-capable Kimi subagents compact self-contained routing, and documents the architecture and maintenance rules.

The configured unqualified-session agent remains makeitwork; this change does not alter default_agent selection.

Fixes #

None — owner-approved prompt architecture refactor.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test workflow run succeeded: repository hygiene, Helm validation, changed-chart detection, and package opencode-server all passed.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated or centrally distributed files changed.
• Reviewed the prompt diff for secret, state, kubeconfig, and credential exposure; GitHub Advanced Security scanning is unavailable for this repository, so CI gitleaks remains the authoritative secret-scanning check.
• Confirmed the shared safety floor retains encrypted/approved secret storage and explicit-confirmation requirements after a targeted review fix.

Impact and rollout

Producer: makeitworkcloud/charts owns the packaged OpenCode prompts and chart configuration.

Validated authored impact: this PR bumps opencode-server from 0.1.60 to 0.1.61 and changes only packaged instructions and chart documentation. After an explicitly approved merge, the main workflow may publish the immutable chart and automatically open or update the separate kustomize-cluster version-pin PR. That PR, controller reconciliation, workload health, and representative agent behavior remain separate, unverified stages.

Rollback: select the prior immutable chart version through the canonical kustomize-cluster Application after the normal rollout/rollback process; do not republish an OCI tag.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change: an OpenCode agent materially produced this refactor and documentation; reviewers should assess the prompt-policy split and role-specific restrictions closely.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.