feat: enable filesystem tools for coverage validation

[motatoes]

Summary

• register the runtime-provided bash and read tools in opencode.json and expose both from the reactive agent render
• instruct the agent to use filesystem access only inside the exact returned snapshot and reserve GitHub operations for the audited code-defined tools
• keep the reviewed and materialized commit SHAs inside session-scoped tool state so the model cannot substitute an unrelated SHA
• document the temporary launch trust boundary and disposable-repository rollout precautions

Risk

bash can execute untrusted repository scripts, and read is not technically restricted to the materialized snapshot. This is an explicit launch tradeoff until a constrained repository executor is available. The example defaults publication off and recommends a fine-grained PAT scoped to one disposable or non-production repository.

Verification

• npm test — 7 tests passed
• npm run typecheck — passed
• built the deploy artifact and confirmed opencode.json registers and permits bash and read
• confirmed the reactive manifest exposes both runtime tools
• confirmed the packaged materialization schema accepts no model-supplied ref and the publication schema accepts no model-supplied base SHA
• confirmed the packaged GitHub connection permits redirects to https://codeload.github.com/