Fix opencode install: download musl binary directly from GitHub

The opencode.ai install script fails in CI (TLS errors, missing $SHELL).
Download the pre-built musl binary directly from GitHub releases instead.
Verified locally on linux/amd64 with PTY spawn.

apps/harness/Dockerfile

@@ -40,8 +40,9 @@ RUN apk add --no-cache git github-cli curl ca-certificates
 
 # Agent CLIs (installed globally before dropping to non-root)
 RUN npm install -g @anthropic-ai/claude-code @openai/codex
-RUN SHELL=/bin/sh curl -fsSL https://opencode.ai/install | SHELL=/bin/sh sh && \
-    cp /root/.opencode/bin/opencode /usr/local/bin/opencode
+RUN ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/') && \
+    curl -fsSL -L "https://github.com/anomalyco/opencode/releases/latest/download/opencode-linux-${ARCH}-musl.tar.gz" \
+    | tar xz -C /usr/local/bin opencode
 
 # MCP servers: Gitea (Go binary from builder stage)
 COPY --from=gitea-mcp-builder /usr/local/bin/gitea-mcp /usr/local/bin/gitea-mcp