feat(opencode): read approved private cache entries

[xnoto]

Summary

Updates every primary agent to prefer repo-search for ordinary cached reads of public repositories and owner-approved private cache entries. Grants the packaged OpenCode configuration the requested /repos/* path permissions and releases opencode-server chart 0.1.65.

Fixes #

None — owner-approved repository-routing change.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test run 33945440259 passed repository hygiene and Helm validation.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed.
• Manual diff review: all nine primary-agent definitions retain GitHub MCP for access/visibility checks, writes, and freshness-critical reads; the existing read-only repo-search routing remains intact.

No local Helm, OpenTofu, Kubernetes, or live-system operation was run or claimed. CI is the validation authority.

Impact and rollout

Producer: this change packages immutable chart opencode-server 0.1.65; it does not create a new MCP endpoint or change the read-only backend. The separate kustomize-cluster private-cache PR must make the approved private cache entries available before this routing is functionally useful.

Consumer: OpenCode receives the updated primary prompts, documentation, and /repos/* path-scoped permissions. Subagent definitions are unchanged. GitHub MCP remains required for GitHub mutations, access/visibility checks, and freshness-critical source.

Delivery stages: this PR authors and validates chart content only. After an explicitly approved merge, main may publish the immutable OCI chart and automatically open/update the separate kustomize-cluster version-pin PR. That desired-state update, Argo CD reconciliation, workload health, and representative agent behavior require separate evidence.

Rollback: select the previous immutable opencode-server chart version through a reviewed GitOps change; never patch the running ConfigMap or Deployment.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; the diff was manually inspected. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the exact /repos/* permission expansion, primary-only scope, and chart-version bump before merging.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.