fix: auto-allow all opencode permissions in sandbox

Sets "permission": "allow" in opencode.json so every permission check
resolves to allow via the findLast rule in permission/evaluate.ts.

Without this, OpenCode's permission system blocks on Deferred.await
with no timeout whenever a tool hits an "ask" rule (e.g., read tool
triggering external_directory on paths outside the worktree, or on
task subagent sessions that upstream code can't approve).

Since the sandbox is an isolated gVisor environment running trusted
agent code, fine-grained permissions add no security value — they
only create deadlock opportunities.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gluonfield

entrypoint.sh

@@ -9,6 +9,7 @@ export OPENCODE_DB=/data/opencode/opencode.db
 
 cat > /home/sandbox/.config/opencode/opencode.json <<EOF
 {
+  "permission": "allow",
   "provider": {
     "openrouter": {
       "npm": "@ai-sdk/openai",