fix(sms-bridge): use end-to-end OpenCode V2 flow

[xnoto]

Summary

• Keep the bridge on one OpenCode V2 contract: admit a text prompt, wait for the session, then retrieve assistant message content.
• Reject unmapped V2 file parts safely rather than silently dropping attachments; V2 image-file mapping remains a separate follow-up.
• Preserve the signed ingress sender gate before enqueue; regression coverage continues to prove unapproved senders do not enter downstream processing.

Fixes #

None — owner-authorized repair after the selected legacy message-route attempt still failed at the OpenCode stage.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — buildah run 33945461180 passed pre-commit, changed-image detection, and the non-publishing bridge image build.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none changed.
• Focused unit coverage asserts V2 prompt admission, wait, and message retrieval; assistant text extraction; V2 file-part rejection; and the pre-enqueue unapproved-sender gate.

No local tests, container builds, OpenTofu, SOPS, state, or live-system operations were run or claimed. CI is the validation authority.

Impact and rollout

Producer changed: makeitworkcloud/images/opencode-sms-bridge is the canonical bridge-image source. An approved merge automatically publishes a new immutable GHCR image tag.

Consumer unchanged: kustomize-cluster currently selects the functionally failing image f1e92b0f159230b56f846ab69e6f81057eb796b1; this PR neither selects nor deploys the V2 repair. After an approved merge and publication, a separate reviewed GitOps PR and explicit confirmation are required before image selection, Argo reconciliation, health verification, and a new approved-source SMS test.

Behavior boundary: text-only prompts use the OpenCode V2 path. Image parts are deliberately rejected until the V2 prompt.files mapping is separately designed and tested; no attachment data is silently omitted from an OpenCode prompt.

Rollback: if a later selected image regresses, use the canonical GitOps workflow to select a reviewed immutable image tag. Do not overwrite image tags or alter live state manually.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; the two-file diff was manually inspected. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the OpenCode V2 contract, attachment boundary, sender gate, and CI results before merge.

[github-actions]

Image CI passed

Pre-commit validation passed. View the workflow run.