fix(sms-bridge): select compatible OpenCode prompt image

[xnoto]

Summary

• Select the published SMS bridge image that repairs the compatible OpenCode prompt route.
• Preserve the existing chart, workload overlay, routing, allowlist, Secrets, Service, PVC, and TunnelBinding.

Fixes #

None — owner-authorized selection of the published SMS bridge repair image.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — test run 33944551751 passed repository pre-commit validation.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none changed.
• Diff manually verified: one immutable image-tag replacement in the existing Application.

No local Kubernetes, Kustomize, SOPS, OpenTofu, image, or live-system operations were run or claimed. CI is the validation authority.

Impact and rollout

Producer: images PR #33 merged at f1e92b0f. Its successful publishing buildah run built and pushed the exact immutable image selected here.

Consumer: workloads/apps/opencode-sms-bridge-app.yaml selects image f1e92b0f159230b56f846ab69e6f81057eb796b1 in the existing opencode-sms-bridge Application. Chart 0.1.2, both Application sources, opencode namespace, webhook URL, workload overlay, encrypted Secrets, sender allowlist, mapping, Service, PVC, TunnelBinding, and Twilio configuration are unchanged.

Delivery stages: this PR authors desired state only. After an approved merge, main CI must pass; the sync workflow then submits the tested revision for the independent App-of-Apps roots. gitops-workloads must reconcile the child Application, whose automated policy then reconciles the selected image. Root/child revisions, sync/health, resource tree, Deployment rollout, and approved-source SMS reply behavior remain unverified until separately checked. Do not merge or perform an Argo sync without explicit owner confirmation.

Rollback: use a reviewed GitOps PR to reselect prior known-good immutable image fe2c1cb435ca5f2f2c657f7b73a5d15c1ba95070; never retag an image or patch the live Deployment.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; the one-line diff was manually inspected. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the exact image tag, retained ownership boundaries, and CI results before merge.