Emit `codeguard-reviewer` subagent for OpenCode

[thomas-bartlett]

The codeguard-reviewer subagent currently only emits for Claude and
Cursor (see AGENT_HOSTS in src/artifact_targets.py). OpenCode users
get the CodeGuard skill but not the reviewer agent.

Add a .opencode entry to AGENT_HOSTS so the converter emits
.opencode/agents/codeguard-reviewer.md. The emitted file needs
mode: subagent in its YAML frontmatter (per-host frontmatter is already
supported via the fm field), and the agent should read rule files from
.opencode/skills/software-security/rules/*.md (already populated by the
converter).

Open question: whether to set permission: {bash: deny} in the
frontmatter. The schema supports it, but if OpenCode routes its grep/glob
tools through bash, denying it breaks the agent's search step.

Test against a real OpenCode install:

• Agent is discovered (appears in the host's agent list/picker)
• Agent is invocable and runs to completion on a small repo
• Agent can read the rule files at the configured path
• SARIF output is produced

Docs: https://opencode.ai/docs/agents/