feat(harness): pre-fetch models.dev catalog in opencode provisioner

[ptone]

Summary

Adds a best-effort pre-fetch step to the opencode provisioner that downloads the latest models catalog from models.opencode.ai during provision and writes it to opencode cache location (~/.cache/opencode/models.json).

Motivation

opencode bakes a models.dev snapshot at build time. When new models are released after the image is built, opencode model validation rejects them. Pre-fetching the catalog during provision ensures fresh model data is available before opencode starts.

Changes

Single file: harnesses/opencode/provision.py

• New function _prefetch_models_catalog(ctx): fetches https://models.opencode.ai/api.json with 10s timeout, writes to cache with atomic tmp+replace pattern
• Best-effort: broad except Exception catches all errors, logs via ctx.info(), never fails provision
• 10MB read cap for defense in depth
• Called after auth resolution, before provision returns
• Stdlib only (urllib.request), no external dependencies

Related: ptone#1283

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request adds a pre-fetching mechanism for the latest models catalog from models.opencode.ai during the provisioning step of the opencode harness, saving it to a local cache to ensure fresh model data. The review feedback suggests validating that the fetched catalog is indeed valid JSON before caching it, preventing potential crashes or parsing failures in opencode if an invalid response or error page is received.