Fix OpenCode plugin runtime compatibility

[backnotprop]

Summary

• split the OpenCode plugin into a portable main entry and a Bun-only embedded runtime so Node-hosted plugin loading does not import Bun server code at module load
• add a CLI bridge fallback for submit_plan and the Plannotator slash-command shims, with OpenCode-visible Plannotator URLs
• preserve OpenCode parity in the CLI bridge by passing share config, paste URL, and an agent snapshot into structured opencode-plan, opencode-review, and opencode-annotate-last modes
• restore CLI fallback behavior for review agent switching, /plannotator-last recent-message picker, OpenCode share disabling, and PR review remote-diff semantics
• move the fetch Request/Response recovery shim into the embedded runtime path and make forced runtime: "embedded" fail clearly on non-Bun hosts
• move plan edit helpers out of the public plugin entry and add export-shape/bridge regression tests for OpenCode legacy loading
• harden OpenCode experimental.primary_tools normalization before injecting submit_plan
• harden the isolated OpenChamber sandbox helper so it starts managed OpenCode on a private port instead of auto-attaching to unrelated 4096 servers

Issues

Closes #596
Closes #847
Closes #681
Related to #733
Related to anomalyco/opencode#25880

Verification

• bun test apps/opencode-plugin/*.test.ts
• PATH="$PWD/apps/hook/node_modules/.bin:$PATH" bun run typecheck
• bun run build:hook
• bun run build:review && bun run build:opencode
• bun test apps/hook/server/*.test.ts
• node -e "import('./apps/opencode-plugin/dist/index.js').then((m)=>console.log(Object.keys(m).join(',')))"
• bun apps/hook/server/index.ts --help
• bun build apps/hook/server/index.ts --outfile /tmp/plannotator-cli-smoke.js --target bun
• ./tests/manual/local/sandbox-opencode-isolated.sh --no-launch
• npm pack ./apps/opencode-plugin, install in a temp project, then node --input-type=module -e 'await import("@plannotator/opencode")'
• OpenChamber isolated harness: health clean on 3017, managed OpenCode on 4097, provider/config/agent endpoints return 200, plan has submit_plan: allow, build has submit_plan: deny