Add an experimental OpenCode v2 runtime for `/review-pr`

[dceoy]

Problem

opencode-action installs OpenCode through the v1 curl installer and invokes opencode github run. OpenCode v2 beta is distributed through the npm next channel, uses the opencode2 executable, and does not currently expose a compatible github run command.

The bundled /review-pr workflow does not require the full OpenCode GitHub event runner: it can execute the trusted review orchestrator and submit structured reviews through fixed helper scripts. This makes review-only mode the smallest viable scope for initial v2 support.

OpenCode v1 currently owns the GitHub App authentication lifecycle inside opencode github run. Because v2 does not provide that runner, the v2 adapter must also own the minimal authentication lifecycle needed to preserve the existing bot identity and review behavior. This authentication scope is folded from #57; v1 should continue using its existing upstream authentication path rather than duplicating it in the action.

Goal

Add opt-in OpenCode v2 support for /review-pr while retaining OpenCode v1 as the default runtime and preserving the existing GitHub App authentication and review security guarantees.

Dependencies

• Validate review-only isolation against OpenCode v2 #58: verified fail-closed review-only isolation for OpenCode v2.

Proposed changes

• Add an explicit runtime input such as:

  runtime: v1 # v1 | v2-beta

  Do not infer the runtime generation solely from opencode-version, because v2 packages may still use 1.x package versions during development.

• Keep runtime: v1 as the default and leave its existing opencode github run authentication lifecycle unchanged.

• Install v2 from a pinned or caller-selected @opencode-ai/cli@next version and invoke opencode2.

• Restrict runtime: v2-beta to detected /review-pr runs; fail clearly for general issue or PR-comment automation.

• For v2 only, add the smallest action-owned GitHub App authentication path required to replace the missing github run behavior:

  • obtain the GitHub Actions OIDC token;
  • exchange it through oidc-base-url for an OpenCode GitHub App installation token;
  • expose the token to the trusted review helpers and any required GitHub API/git operations without logging it;
  • keep use-github-token: true as the explicit fallback that skips App exchange;
  • preserve opencode-agent[bot] as the structured-review identity unless the caller explicitly selects the fallback;
  • revoke the installation token during cleanup after success, failure, or timeout.

• Do not introduce a generalized authentication framework or move v1 authentication into action-owned code solely for symmetry.

• Invoke the bundled review agent through the v2 noninteractive run command.

• Translate the separate model and variant inputs to the v2 provider/model#variant syntax without silently normalizing unsupported values.

• Preserve prompt expansion, explicit agent selection, timeout handling, failure annotations, and action outputs.

• Reuse the existing trusted review helper boundary and identity verification rather than creating a second structured-review submission path.

• Add a v1/v2 CI matrix with a credential-free CLI smoke test and mocked review/authentication helper coverage.

• Document the beta support level, runtime-specific authentication ownership, and compatibility policy.

Acceptance criteria

• runtime: v2-beta successfully starts opencode2 run for /review-pr.
• The existing default workflow remains on v1 with no caller changes and no duplicated action-owned App exchange on the v1 path.
• Non-review prompts fail before execution when v2-beta is selected.
• Before starting a v2 review, the action can obtain and verify the required App token independently of opencode github run.
• use-github-token: true remains an explicit fallback and does not silently alter the default App-backed identity policy.
• App-authored structured reviews use opencode-agent[bot] on the v2 path unless the caller explicitly selected the fallback.
• No App token value appears in logs or GitHub Actions annotations.
• App-token cleanup runs after successful, failed, and timed-out v2 executions.
• Model variants are passed using v2 syntax and invalid combinations remain actionable.
• Hostile repository fixtures from Validate review-only isolation against OpenCode v2 #58 cannot affect the v2 review run.
• Existing structured review submission, stale-head protection, and fail-closed behavior remain unchanged.
• Tests cover v2 installation, command construction, authentication exchange/failure/fallback/cleanup/redaction, timeout, failure propagation, and runtime selection.