feat: add Twilio SMS bridge image

[xnoto]

Summary

• Adds opencode-sms-bridge, a signed Twilio SMS/MMS ingress and durable single-worker image for the four fixed OpenCode mobile agents.
• Encrypts queued payloads, hashes sender identifiers, rejects untrusted media endpoints, strips permitted image metadata, and fails closed on uncertain outbound delivery.

Fixes: None (owner-approved Twilio mobile-agent implementation).

Type of change

• Feature / enhancement
• Container image

Validation

• Required pull-request checks pass — buildah run 33801157036 passed, including the image build.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable.
• The container build ran the included webhook, encrypted-queue, deduplication, and image-sanitization tests.

Impact and rollout

images is the source producer. A confirmed merge publishes ghcr.io/makeitworkcloud/opencode-sms-bridge with an immutable commit-SHA tag. The separate charts change consumes that image only after publication; a future focused GitOps change must select the published image and chart, then independently verify Argo reconciliation, health, and messaging behavior. This PR does not configure Twilio, deploy, or change cluster desired state.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes — rollback is a future consumer pin to a prior published image; no live change occurs here.

AI agent materially produced this change; review the signed-webhook, OpenCode API compatibility, and media-processing boundaries carefully.

[github-actions]

Image CI passed

Pre-commit validation passed. View the workflow run.