fix(security): isolate structured-output sessions from agent tools

[EyJunge1]

Summary

• Fixes Security: internal structured-output sessions can inherit unrestricted tools and loop indefinitely #189 by isolating internal structured-output sessions from ordinary OpenCode agent tools.
• Adds a dedicated least-privilege agent with deny-by-default permissions, a small step cap, and a hard timeout around structured-output generation.
• Keeps existing internal-capture session tracking/title checks so capture and profile sessions still skip normal learning paths.

Test plan

• bun test tests/opencode-provider.test.ts tests/plugin-host-config.test.ts (38 pass)
• Confirm internal capture/profile sessions can still produce structured output (unit coverage for successful structured parse + session create/prompt/delete)
• Confirm ordinary tools (bash, read, memory, etc.) are not available to those sessions (tools: { "*": false, StructuredOutput: true } + deny-by-default permissions asserted in tests)
• Confirm a timed-out / failed structured-output call fails closed without unbounded looping (times out, aborts, and deletes when the prompt never returns)

[tickernelz]

Merged into main as part of the newest-to-oldest integration batch and scheduled for the v2.22.0 release.

The combined four-PR tree was verified with:

• bun install --frozen-lockfile
• cd web && bun install --frozen-lockfile
• bun run typecheck
• bun run build (including the React/Vite production bundle)
• bun test — 287 passed / 0 failed / 631 assertions
• git diff --check

The pushed main tree exactly matches the locally tested synthetic merge tree.

[tickernelz]

Released in v2.22.0. The npm registry artifact was downloaded, checksum-verified, installed with lifecycle scripts disabled, and passed native dependency, libSQL vector, package entrypoint, and bundled web UI checks.