fix: replace plan mode prompt instead of stripping it

[backnotprop]

Summary

• Before: messages.transform hook nuked OpenCode's entire plan mode STRICTLY FORBIDDEN message, leaving the model with no prompt-level guardrails. Models went rogue — writing Python scripts via Bash to edit code (reported by @ilmpc in submit_plan not appear after plan is finished #328).
• After: Replaces the message with a tailored version that keeps the read-only constraint but allows markdown file writing (.md) for plans, specs, docs, etc.

The replacement message:

• Retains STRICTLY FORBIDDEN language for non-markdown edits and destructive bash commands
• Allows .md file writing explicitly
• Keeps the Responsibility section (explore, ask questions, surface tradeoffs)
• Keeps the Important section (no execution, no source code edits)

Test plan

• OpenCode plan mode: agent should use submit_plan and write plan .md files without going rogue
• Agent should NOT attempt to edit source code, run destructive bash, or write Python workarounds
• Non-plan primary agents (Build) should still see submit_plan and work normally
• Weaker models (GPT-5-mini) should respect the STRICTLY FORBIDDEN constraint

Fixes #328

[backnotprop]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}