feat(AI-014): bootstrap OpenCode on Windows via winget SST.opencode

[mlorentedev]

Summary

Mirror of AI-011 (Linux bootstrap, PRs #34/#36/#37, 2026-05-16) on the Windows side. The Linux path uses `curl -fsSL https://opencode.ai/install | bash`; empirical probe 2026-05-21 against winget revealed `SST.opencode` (v1.15.6) is published natively, user-scope installable, PATH handled by winget itself. That is substantially cleaner than the original AI-014 backlog entry's "admin-conditional curl-bash equivalent or npm install" hypothesis and reduces this spec from ~150 LOC of admin-detection logic to ~75 LOC of straight mirror.

Changes

1. setup-windows.ps1 section 1c: append `SST.opencode` to existing `$tools` winget array. Idempotent via foreach's per-tool `Get-Command opencode` guard. Inherits section's post-loop PATH refresh.
2. setup-windows.ps1 new section 2d (after 2c Obsidian CLI):
   • Deploy `ai/opencode/opencode.jsonc` to `%USERPROFILE%.config\opencode\opencode.jsonc` using SHA256 byte-equality test before copy (reconcile-not-skip, mirror of setup-linux.sh:415-428's `cmp -s`).
   • Sync `ai/opencode/commands/*.md` to `%USERPROFILE%.config\opencode\commands\` with add/skip/remove-orphan counters identical to setup-linux.sh:430-465.
3. scripts/healthcheck.ps1 sec 10/12: drop the "AI-014 pending" parenthetical from SKIP messages. PASS path (`Test-Command 'opencode'` true + jsonc deployed) was already wired.
4. tests/setup-windows.bats: 3 new asserts locking the `SST.opencode` entry, the SHA256-guarded jsonc deploy, and the orphan-removal in commands sync.

Spec at `specs/AI-014-opencode-windows-bootstrap/`. Production diff 74 LOC (≥ 50 threshold), spec-gate satisfied.

Empirical probe (2026-05-21)

```
PS> winget search opencode --source winget
opencode SST.opencode 1.15.6
OpenCode SST.OpenCodeDesktop 1.15.6 ProductCode: opencode

PS> Invoke-WebRequest https://opencode.ai/install.ps1 -Method Head
404 Not Found # confirms no PowerShell installer upstream

PS> Invoke-RestMethod https://registry.npmjs.org/opencode-ai | %{ $_.'dist-tags'.latest }
1.15.7 # npm fallback available, not chosen
```

`SST.opencode` (NOT `SST.OpenCodeDesktop` — that is the GUI). User-scope, no admin, winget manages PATH.

Test plan

• PowerShell AST `[Parser]::ParseFile` → clean for both setup-windows.ps1 + healthcheck.ps1
• `Invoke-ScriptAnalyzer -Settings .PSScriptAnalyzerSettings.psd1 -Severity Error,Warning` → clean (no em-dash regression from BUG-014)
• ASCII-only check → 0 non-ASCII chars
• 3 new bats asserts in `tests/setup-windows.bats`
• CI green
• Empirical run on user's Windows: `winget install SST.opencode` succeeds non-elevated; `opencode --version` returns 1.15.x; `opencode.jsonc` SHA256 matches source; commands dir has 12 .md files

Coexistence note

The Hive MCP write-lock race between Claude Code and OpenCode (documented in `40-runbooks/guide-opencode-go-setup.md`) applies cross-OS. Until the hive flock follow-up merges, do not run `oc` and `claude` in parallel on the same repo. Safe pattern: sequential per repo, OR different repos in parallel.

Out of scope

• Porting `scripts/skills-to-opencode.sh` to PowerShell (regeneration stays Linux/CI concern)
• Automating the `/connect` flow (intentionally manual, API-key paste required)
• A separate Windows runbook (the existing `guide-opencode-go-setup.md` is OS-agnostic for /connect/PAYG/troubleshooting; a small "Windows install delta" section gets folded post-merge)

Lesson candidate

"When porting a Linux feature to Windows, probe the native package manager (winget) FIRST before assuming the Linux install path (curl-bash, npm) is the only option. The cleaner channel often exists but is invisible to a Linux-first design."