Fix opencode download: save to disk before extracting

Piping curl directly to tar fails in CI when the download is chunked,
causing "not found in archive". Download to a temp file first.
Verified on linux/amd64.

apps/harness/Dockerfile

@@ -41,8 +41,10 @@ RUN apk add --no-cache git github-cli curl ca-certificates
 # Agent CLIs (installed globally before dropping to non-root)
 RUN npm install -g @anthropic-ai/claude-code @openai/codex
 RUN ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/') && \
-    curl -fsSL -L "https://github.com/anomalyco/opencode/releases/latest/download/opencode-linux-${ARCH}-musl.tar.gz" \
-    | tar xz -C /usr/local/bin opencode
+    curl -fsSL -L -o /tmp/opencode.tar.gz "https://github.com/anomalyco/opencode/releases/latest/download/opencode-linux-${ARCH}-musl.tar.gz" && \
+    tar xzf /tmp/opencode.tar.gz -C /usr/local/bin && \
+    rm /tmp/opencode.tar.gz && \
+    opencode --version
 
 # MCP servers: Gitea (Go binary from builder stage)
 COPY --from=gitea-mcp-builder /usr/local/bin/gitea-mcp /usr/local/bin/gitea-mcp