Validate review-only isolation against OpenCode v2

[dceoy]

Problem

The current /review-pr security boundary depends on OpenCode v1 configuration discovery and environment flags, including:

• OPENCODE_DISABLE_PROJECT_CONFIG=1;
• OPENCODE_DISABLE_EXTERNAL_SKILLS=1;
• clearing OPENCODE_CONFIG, OPENCODE_CONFIG_DIR, and OPENCODE_CONFIG_CONTENT;
• installing the bundled toolkit into the expected global configuration directory;
• restricting the orchestrator to fixed helpers and review-state files.

OpenCode v2 changes its configuration, skills, plugins, agents, tools, and permission implementation. Reusing the existing flags without verification could allow an untrusted pull request to inject configuration, skills, plugins, agents, or executable behavior into a review-only run.

Goal

Establish and test a fail-closed review-only execution boundary for OpenCode v2 before enabling it in opencode-action.

Proposed changes

• Identify every v2 configuration and extension discovery source that can affect a noninteractive run:
  • repository and nested configuration files;
  • global and managed configuration;
  • environment-provided configuration;
  • project and external skills;
  • plugins and integrations;
  • persisted authentication or remote organization configuration;
  • agent and command discovery.
• Determine which v1 isolation flags remain supported and what their exact v2 semantics are.
• Build hostile repository fixtures that attempt to override the selected model, agent, permissions, command, skill, plugin, and review helper behavior.
• Ensure /review-pr uses only the bundled orchestrator, reviewers, skill, scripts, and state files.
• Verify the worktree remains unchanged and no commit or push path can execute.
• Fail before model execution when the action cannot establish the required isolation boundary.
• Document the security assumptions and unsupported runner configurations.

Acceptance criteria

• Automated tests demonstrate that repository-controlled v2 config, skills, plugins, and agents cannot alter a review-only run.
• The selected bundled review agent and skill are deterministic.
• Review-only runs cannot modify, commit, or push repository files.
• Unsupported or unverifiable isolation states fail closed with an actionable annotation.
• The v1 review-only tests continue to pass.