feat: add Twilio SMS bridge chart and mobile agents

[xnoto]

Summary

• Adds the portable opencode-sms-bridge chart with hardened ingress/worker containers, a single-writer RWO state contract, and named Secret-reload wiring.
• Adds four tool-denied *-sms OpenCode primary agents and bumps opencode-server to 0.1.58 for immutable configuration publication.

Fixes: None (owner-approved Twilio mobile-agent implementation).

Type of change

• Feature / enhancement

Validation

• Required pull-request checks pass — charts run 33801480129 passed hygiene, Helm validation, and both chart packaging jobs.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable.

Impact and rollout

The bridge chart requires a published immutable image SHA and a later cluster-owned PVC, Service, TunnelBinding, and SOPS Secret overlay. The opencode-server release automatically opens a separate GitOps version-pin PR after confirmed publication; that desired-state change does not deploy by itself. Do not configure Twilio webhooks until the later GitOps selection is reconciled, healthy, and explicitly approved for functional testing.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes — consumer selection must use immutable prior chart/image references; no live change occurs here.

AI agent materially produced this change; review mobile-agent tool denial, Reloader annotations, and chart-to-GitOps ownership boundaries carefully.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.