fix(opencode-go): preserve sessions across all Go model wires

[tmhise]

Why

OpenCode Go requires a stable session identifier for each conversation. CodexCommander routes Go models over Chat Completions, Anthropic Messages, and OpenAI Responses; a missing x-opencode-session on any of these paths makes upstream requests fail with MissingSessionID. The fix belongs to the canonical Go provider transport so it applies to every supported Go model, including Codex subagents.

Changes

• Derive an opaque x-opencode-session from the Codex task/session ID for the canonical Go provider, across all three documented wire formats. Sibling subagents get distinct IDs; sessionless requests get isolated temporary IDs. Preserve an operator-configured header and identify the proxy with its own user agent.
• Preserve an explicit Go session header through the Chat Completions and Messages ingress bridges. Claude Code turns also derive a stable session from per-conversation metadata when available.
• Refresh the trusted Go catalog with three currently advertised IDs (deepseek-v4.1-flash, glm-5.3-flash, qwen3.8-flash) and their documented wire and capability metadata. The transport fix itself has no model-ID allowlist.
• Add focused routing, catalog, and regression coverage and update the provider guide.

Validation

• bun test tests/opencode-go-session.test.ts tests/opencode-go-catalog.test.ts tests/opencode-go-deepseek.test.ts tests/provider-registry-parity.test.ts — 56 passed.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• cd docs-site && bun run build — passed.
• Live requests through a separate patched local server to six Go models — deepseek-v4.1-flash, glm-5.2, glm-5.3-flash, qwen3.8-max, qwen3.8-flash, and gpt-5.6-luna — all returned HTTP 200 with completed OK answers. Together they cover Chat Completions, Anthropic Messages, and OpenAI Responses.
• bun run test:parallel — all 630 files passed locally on the amended commit, including the runner's same-mode retries. GitHub CI is rechecking the amended head.

Security considerations

The header contains a scoped SHA-256 digest rather than a raw Codex task ID or Claude metadata value. It is added only for the canonical fixed-key OpenCode Go destination. Configured provider headers retain precedence. The new Messages path does not forward raw metadata or credentials to Go. The change does not modify authentication, credentials, or request logging.

[pavelhov]

Reviewed the canonical OpenCode Go transport and all three wire paths. The Claude Code Messages session gap was fixed and independently reviewed. Session values are opaque hashes, attach only to the canonical fixed-key Go destination, and configured headers retain precedence. Focused tests, typecheck, privacy scan, docs build, and all 630 local test files pass on fec4910; awaiting the amended CI run before merge.