fix: use workflow token for OpenCode GitHub access

[PANDAJSR]

Summary

• use the workflow GITHUB_TOKEN directly instead of the OpenCode App/OIDC token
• bypass the OpenCode bot collaborator check that reports opencode-agent[bot] as having no permissions
• keep contents, issues, and pull requests write permissions on the job

Issue #10 failed before starting the agent with:

User opencode-agent[bot] does not have write permissions

The OpenCode App is installed, but OpenCode 1.18.25 checks the App bot through the collaborator API, which returns none for the bot identity. The documented use_github_token: true path avoids that check and uses the Actions token for branch, commit, comment, and PR operations.

Validation

• workflow YAML parsed successfully
• confirmed id-token: write is removed because OIDC is bypassed

Failed run: https://github.com/SECTL/SecAgent/actions/runs/33510116030