feat(opencode): guard parity via tool.execute.before/after

[thewrz]

This was written agentically; verify its assertions:

Why

On Claude Code, agent-kit's PreToolUse/PostToolUse hooks provide the write-boundary guard and the paths-touched.ndjson forensic evidence that parallel-issues' cross-write Collect check depends on. Under OpenCode those hooks never fire, so a dispatched worker runs with no ownership-boundary evidence at all — the Collect check degrades to mtime archaeology.

What

• Port the guard layer to OpenCode's typings-verified hooks: tool.execute.before (record + optionally refuse a content-bearing write whose target escapes the contracted worktree) and tool.execute.after (append the same paths-touched.ndjson record shape the Claude hooks write, so cross-write-check.sh consumes one format).
• permission.ask hook: surface (not silently allow) out-of-boundary writes when interactive; degrade to record-only when unattended.
• Scope guard logic to parse tool argv as data, matching the existing guards' data-vs-executed discipline (see the guard-class fixes Pinned-plugin-path hook matches quoted paths in data payloads, not just executed ones #299/post-receipt.sh and finding-ledger.sh address the same run directory two different ways #300 — do not regress into whole-command-text matching).
• Reuse the guard shell helpers where possible by invoking them from the plugin ($ Bun shell) rather than reimplementing matching logic in JS; where JS-side matching is unavoidable, pin parity with fixture tests shared across both implementations.

Acceptance

• A write inside the worktree under OpenCode produces a paths-touched.ndjson record identical in shape to the Claude-hook record (fixture diff test)
• An out-of-worktree write is recorded and surfaced per the mode (interactive ask / unattended record)
• cross-write-check.sh collect consumes OpenCode-produced evidence unchanged
• Guard parity fixtures run against both implementations in CI
• Unit tests pass; CI green

Blocked by the contract-injection slice (S3).

🤖 Co-authored by Claude Fable 5.

[thewrz]

This was written agentically; verify its assertions:

Added #335 as a blocker. Reason, so the ordering is not mysterious later:

This slice ports the guard layer to OpenCode's tool.execute.before/after and explicitly commits to "parse tool argv as data, matching the existing guards' data-vs-executed discipline (see the guard-class fixes #299/#300 — do not regress into whole-command-text matching)."

Field evidence in #335 shows the current Claude/Codex-side scope guard has regressed into exactly that: it classified path-shaped text inside a quoted heredoc body as an out-of-workspace read and emitted a classification: foreign advisory for a path nothing referenced. #335 also covers a second classifier defect this port would inherit — plugin-cache skill trees belonging to the running harness classified as foreign rather than harness.

Porting against the current classifier would carry both defects into the OpenCode implementation and then pin them with the parity fixtures this slice's acceptance criteria require — the fixtures would encode the bug as the contract. #335 lands the argv-parsing fix and the harness classification on the existing implementation first; this slice then ports a correct classifier and the shared parity fixtures assert the right behavior on both sides.

No scope change to this slice; the acceptance criteria stand as written.

🤖 Co-authored by Claude Opus 5.