ci: add automated OpenAI grant rotation workflow (device flow)

[xnoto]

Summary

Adds .github/workflows/rotate-opencode-openai.yml, a workflow_dispatch workflow that rotates the OpenAI OAuth grant in workloads/opencode/opencode-openai-secret.yaml end to end:

1. Runs opencode auth login --provider openai --method "ChatGPT Pro/Plus (headless)" (verified device flow on the deployed CLI 1.18.23) and surfaces the device URL and code in the run summary.
2. Regenerates the Secret manifest and encrypts with sops --encrypt under the repository creation rules — encryption-only, so CI holds no age key and no Actions secret beyond the App key below.
3. Bumps auth-seed-revision to <date>-<run_number> in the same change so the seed-openai-auth init container re-seeds the home PVC.
4. Commits to a rotation branch, opens a pull request, and enables auto-merge using a scoped makeitworkbot installation token (actions/create-github-app-token, mirroring the charts post-publish pattern), which branch protection on main allows to complete the merge once the required test check passes. Includes a branch-update fallback for the strict up-to-date requirement.

Type of change

• CI / reusable workflow

Validation

• Required pull-request checks pass — test (pre-commit): success
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files touched

Design evidence: CLI behavior probed on the deployed image version (device flow output, no localhost callback), install steps pinned to opencode-ai@1.18.23 and sops v3.13.3 with checksum verification, and the App-token merge pattern copied from the proven charts update-opencode-gitops job. First dispatch is the smoke test.

Impact and rollout

Prerequisite: makeitworkcloud/tfroot-github#58 distributing CHART_UPDATER_GITHUB_APP_PRIVATE_KEY to this repository must be applied before the first dispatch; until then the token step fails fast. The workflow is dispatch-only, serialized by a concurrency group, and never syncs Argo CD — generated rotation pull requests merge through the required test check, then the existing Argo CD + Reloader + init-container chain applies them.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints — the decrypted grant exists only in ephemeral runner memory, is never echoed or uploaded, and the generated commit is ciphertext plus the deliberately non-secret revision key. The device URL and one-time code appear in the run summary by design; they are short-lived and single-use
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed
• Breaking or irreversible effects are described above with rollback notes — rotation intentionally replaces the persisted grant; rollback restores prior ciphertext with a new revision value

Agent disclosure: workflow, branch, and this pull request were prepared by the makeitwork OpenCode agent at the owner's direction.