Switch opencode download to cluster-local Garage object store

Download from garage.platform.svc:3902 (web gateway) instead of
GitHub releases. Eliminates external network dependency during builds.
Verified download works from inside DinD-spawned containers.

apps/harness/Dockerfile

@@ -41,10 +41,11 @@ RUN apk add --no-cache git github-cli curl ca-certificates
 # Agent CLIs (installed globally before dropping to non-root)
 RUN npm install -g @anthropic-ai/claude-code @openai/codex
 RUN ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/') && \
-    curl -fsSL -L -o /tmp/opencode.tar.gz "https://github.com/anomalyco/opencode/releases/latest/download/opencode-linux-${ARCH}-musl.tar.gz" && \
+    curl -fsSL --connect-timeout 5 --max-time 30 -o /tmp/opencode.tar.gz \
+      -H "Host: artifacts.web.garage.svc" \
+      "http://garage.platform.svc:3902/opencode/opencode-linux-${ARCH}-musl.tar.gz" && \
     tar xzf /tmp/opencode.tar.gz -C /usr/local/bin && \
-    rm /tmp/opencode.tar.gz && \
-    opencode --version
+    rm /tmp/opencode.tar.gz
 
 # MCP servers: Gitea (Go binary from builder stage)
 COPY --from=gitea-mcp-builder /usr/local/bin/gitea-mcp /usr/local/bin/gitea-mcp