Fix opencode install: set SHELL env for Alpine compatibility

The opencode installer script requires $SHELL to be set, which Alpine's
sh in Docker doesn't provide. This caused the install to download the
binary but fail before placing it, silently swallowed by the || fallback.
Also hardcode the known install path and fail the build if it's missing.

apps/harness/Dockerfile

@@ -40,12 +40,8 @@ RUN apk add --no-cache git github-cli curl ca-certificates
 
 # Agent CLIs (installed globally before dropping to non-root)
 RUN npm install -g @anthropic-ai/claude-code @openai/codex
-RUN curl -fsSL https://opencode.ai/install | sh || \
-    echo "WARN: opencode install failed, skipping"
-# Ensure opencode is on PATH (installer may place it in ~/.opencode/bin or ~/.local/bin)
-RUN for p in /root/.opencode/bin/opencode /root/.local/bin/opencode; do \
-      if [ -f "$p" ]; then cp "$p" /usr/local/bin/opencode; break; fi; \
-    done
+RUN SHELL=/bin/sh curl -fsSL https://opencode.ai/install | SHELL=/bin/sh sh && \
+    cp /root/.opencode/bin/opencode /usr/local/bin/opencode
 
 # MCP servers: Gitea (Go binary from builder stage)
 COPY --from=gitea-mcp-builder /usr/local/bin/gitea-mcp /usr/local/bin/gitea-mcp