fix(opencode): send x-opencode-session header to OpenCode Go provider

[Usman0220]

Summary

OpenCode Go began enforcing the x-opencode-session header on 2026-09-05 to optimize routing and prompt caching. Every request made through the built-in opencode-go provider is now rejected:

AI_APICallError: Request is missing x-opencode-session and cannot be routed efficiently.

Upstream OpenCode (v1.18.x) works against the same endpoint because it sends the header natively per session. This PR ports those send points into pentestcode.

Changes

• packages/opencode/src/session/llm/request.ts — replace the x-pentestcode-* headers with the canonical x-opencode-* headers (x-opencode-session, x-opencode-request, x-opencode-client, x-opencode-project) for all opencode* providers, and apply x-parent-session-id uniformly across both provider branches (matches upstream anomalyco/opencode behavior).
• packages/core/src/session/runner/llm.ts — add the missing http.headers send point (x-session-affinity, X-Session-Id, x-parent-session-id) so auxiliary/runner requests carry the session too, including x-opencode-session when the model provider is opencode*.

Why not keep x-pentestcode-*?

The x-pentestcode-* headers were only produced in request.ts and consumed nowhere in this repo — swapping them for the upstream x-opencode-* names is safe and fixes routing to https://opencode.ai/zen/go/v1.

Testing

• Built from source (bun run build --single --skip-embed-web-ui), smoke test passed.
• Requests to opencode-go/* models now carry a stable per-conversation session ID in x-opencode-session.