Fix: opencode auto-memory-update leaks full transcript via process argv (ps/procfs)

[priyamkarn]

Bug

runOpenCodeAgent (libs/agent-runner/opencode.ts) passed the full working-memory-update
prompt -- which embeds the entire session transcript -- as a literal -p <text>
command-line argument to the opencode binary:

const args = ["-p", input.prompt, "-f", "json", "-q"];

Process arguments are visible to other local users via ps aux / /proc/<pid>/cmdline
for as long as the process runs. This isn't a one-off CLI invocation -- it runs
automatically and unattended via the background hook worker on every coding session
(libs/hooks/worker.ts), so the exposure window recurs continuously.

Why opencode specifically

• codex.ts already writes the prompt to stdin -- safe.
• openhands.ts already writes it to a task file and passes the path -- safe.
• opencode.ts was the outlier, passing raw content via argv.

I checked opencode's actual CLI docs before assuming "just switch to stdin" would work:
its prompt argument has no stdin or file-path option, only a literal -p value. So this
needed a different fix than the other two platforms use.

Fix

Write the prompt to a file (opencode-task-prompt.md) inside the same private run
directory worker.ts already creates via mkdtempSync (mode 0700 per POSIX), and pass
only a short, non-sensitive wrapper referencing that file path as the -p value. The
agent reads its real instructions itself via its own file tool -- same effective prompt
content, just relocated out of argv.

Confirmed runOpenCodeAgent has exactly one call path in the codebase (via worker.ts),
so this directory-privacy assumption holds everywhere it's actually used today.

Tests

scripts/check-opencode-prompt-file.js stubs a fake opencode binary that records its
own argv, runs the real built runOpenCodeAgent against it, and asserts: the sensitive
marker never appears in argv, the -p value references the prompt file, and the real
prompt content was actually written there. Wired into npm test.