fix(extensions): align OpenCode local source ordering

[limityan]

Summary

• align active OpenCode Command, Subagent, and MCP providers with the local source order in OpenCode v1.18.9
• share one adapter-private resolver for project config order, ConfigPaths.directories order, physical-path alias handling, and creation-safe watch roots
• preserve XDG and legacy user sources when OPENCODE_CONFIG_DIR is set, while keeping the explicit source workspace-local
• add control-plane acceptance coverage for nested workspaces, updates, deletion fallback, suppression, source labels, watch roots, and aliased directories
• refresh the compatibility docs and explicitly reject a public SourceGraph as part of this slice

Problem

OpenCode loads project config files root-to-opened, but processes project .opencode directories opened-to-root and keeps the first physical directory when ConfigPaths.directories contains aliases. The existing Command path encoded most of that behavior, while Subagent and MCP could select the opposite nested winner. MCP environment options also treated OPENCODE_CONFIG_DIR as a replacement for the normal XDG/legacy roots.

That mismatch could select a different Agent prompt or MCP endpoint from OpenCode in nested monorepos, and could leave inconsistent source labels and watch coverage across the three active providers.

Scope and boundaries

This PR keeps the existing provider and ExternalSourceControlPlane ownership model. The new ordering types are crate-private. It does not add a public source graph, cache, coordinator, protocol, UI, remote/organization/MDM sources, package installation, Hook execution, Workspace Instructions, Skill sources, or Plugin Runtime behavior/dependencies.

Compatibility is pinned to OpenCode v1.18.9, commit 4da7bb44c84e013fa53e9c5d02ac753d1435c81a.

Validation

• cargo check --workspace
• cargo test -p bitfun-opencode-adapter
• cargo test -p bitfun-core opencode_local_source_order_tests --lib
• node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• git diff gcwing/main...HEAD --check

The clean worktree check used the same empty src/mobile-web/dist directory prerequisite as the Rust CI job; no generated artifact is committed.

Adversarial review

An isolated review found one P1 in the first implementation: post-expansion last-wins deduplication moved aliased explicit directories to the end, unlike OpenCode's first-wins unique. A failing three-provider control-plane test reproduced it for both XDG-root and nested .opencode aliases. The private resolver was corrected to preserve the first physical position while applying explicit scope/loading semantics there. Focused tests and a second isolated review then passed with no remaining P0-P2 findings.

Development note: AI-assisted; all validation listed above was run locally on the rebased commit.