feat(opencode): default web sessions to generic agent

[xnoto]

Summary

Set OpenCode's default_agent to default so unqualified web UI sessions load the generic full-capability primary agent rather than makeitwork. Update the agent-instruction architecture and bump immutable chart version 0.1.63 → 0.1.64.

Fixes: N/A — owner-approved routing change.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — workflow run 33941293859 passed repository hygiene, Helm validation, changed-chart detection, and package opencode-server.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none apply.
• Reviewed the complete three-file branch diff; it changes only default-agent routing, its canonical design note, and the required immutable chart version.
• No local Helm, OpenTofu, or repository checks were run or claimed; CI is the validation authority.

Impact and rollout

Producer changed: makeitworkcloud/charts/opencode-server owns the packaged non-secret OpenCode configuration. The ConfigMap copies files/opencode.json and all selectable agent files into the runtime configuration; this change selects the existing default.md agent for unqualified sessions.

Automatic after approved merge: the charts main workflow packages and publishes OCI chart opencode-server:0.1.64, then opens or updates makeitworkcloud/kustomize-cluster's version-pin pull request for workloads/apps/opencode-app.yaml and enables its auto-merge.

Separate confirmation/verification stages: the generated GitOps pull request, its required checks and merge, Argo CD root/child reconciliation, resource health, and an authenticated representative web UI/API request remain distinct. Rollback is a reviewed GitOps version-pin change to 0.1.63; never overwrite the immutable OCI artifact.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints. GitHub Advanced Security secret scanning is unavailable for this repository; the complete diff was manually reviewed.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: an OpenCode agent materially produced this routing change and release documentation update.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.