* feat(permission): config order fix + IntelliSense for tool keys

Sync from anomalyco/opencode v1.14.20..17701628bd:

* fix permission config order (#24222) — drop wildcard sort, preserve
  user key order so permission precedence matches the order users write
  in config (66f93035b0)
* core: full IntelliSense for all tool permission keys via InfoZod
  override (1b92c95425)

Carve-outs preserved:
- packages/opencode/src/permission/index.ts kept on PawWork (legacy
  task→agent alias, list() endpoint, refactored reply state machine)
- tests kept on HEAD (PawWork tests diverged after agent rename)
- packages/sdk/js + openapi.json kept on HEAD; will regenerate in
  Stage I

Refs anomalyco/opencode#24222 #24235
PawWork issue: #209 (PR5 of upstream sync)

* fix(provider): backport upstream provider fixes

DeepSeek (#24146 preserve empty reasoning_content, #24157 variants,
#24163 max support, #24180 ensure assistant reasoning), OpenRouter
sdk bump (#24435), Codex (#23925 model logic — already incorporated
into PawWork's shouldKeepCodexOAuthModel helper), Mistral Small
reasoning (#23735), Kimi variants (#23696), Google Vertex tool call
streaming default (#24573), OpenAI retry/oauth (#24063, #24212),
reasoning transforms split (#24574).

Carve-outs preserved:
- packages/opencode/src/plugin/codex.ts kept on PawWork (helper
  refactor of allowed model logic — upstream change is functionally
  equivalent)
- packages/opencode/package.json kept PawWork-specific workspace
  deps (@opencode-ai/core, @opencode-ai/util); only @openrouter
  bump applied

Refs anomalyco/opencode #23696 #23735 #23925 #24063 #24146 #24157
#24163 #24180 #24212 #24435 #24573 #24574
PawWork issue: #209

* fix(runtime): backport shell cwd + tool_output config schema

Functional changes from upstream batch (#23797 BOM, #23770 truncate
config, #23870 compaction, #19054 bare-repo, #24215 shell cwd):

* session/prompt.ts: shell invocations now pass cwd as positional arg
  ("$1") instead of capturing $PWD before sourcing shell init files
  (#24215)
* config/config.ts: add tool_output { max_lines, max_bytes } schema
  for user-configurable truncation thresholds (#23770)

Already incorporated in HEAD (no-op cherry-picks):
- BOM round-trip (Bom.syncFile already wired in edit/write/apply_patch)
- Project bare-repo cache (isBareRepo + readCachedProjectId(common)
  already in project.ts)

Deferred to Post-merge tool re-sync (#19):
- Truncate config wiring inside truncate.ts (namespace structure
  diverged; needs structural merge)
- Session compaction rewrite (#23870 SUMMARY_TEMPLATE/Turn/Tail
  redesign vs PawWork's anchored template)

Refs anomalyco/opencode #19054 #23770 #23797 #23870 #24215
PawWork issue: #209

* chore(sdk): regen types after permission/config schema updates

Stage I regen reflects:
- PermissionConfig gains explicit tool keys with intersection record
  type (Stage F: #24222 + #24235 IntelliSense)
- Config.tool_output { max_lines, max_bytes } block added
  (Stage G.2: #23770 truncation thresholds)

Refs: #209

* fix(upstream): address PR5 review feedback

* fix(upstream): address provider review feedback

* test(upstream): cover vertex anthropic streaming option

* fix(upstream): harden shell cwd wrapper