opencode: link the guard config, and turn off native Plan Mode

Two things, one of them overdue.

1. ~/.config/opencode/opencode.json is now dotbot-linked on mainframe and
   sctfw004. It has lived in the repo since August while being linked
   NOWHERE -- each machine had a hand-placed copy and nothing checked they
   agreed, or that the Zen guard was there at all. That file is what stops a
   bare `opencode` falling back to built-in providers including OpenCode Zen,
   which is under a ToS block. An unverified guard is not a guard.

2. It carries `agent.plan.disable: true` and `permission.plan_enter: deny`.
   opencode's native Plan Mode was activating unbidden and taking sessions
   read-only with "Plan mode is active ... This supersedes any other
   instructions you have received."

⚠ (2) IS A PREFERENCE, NOT A FIX. Remove those two keys to restore Plan Mode.

⚠ This is NOT OMO, despite looking like it. OMO's agents carry only
description/model/tools -- there is no keyword or prompt-text trigger
anywhere in ~/.omo/omo.jsonc. `plan` is native to opencode. Verified:
`agent list` shows plan gone under the local profile, and plan_enter
resolving to deny on `build` under personal, where the OMO plugin re-adds
plan as a subagent.

⚠ Turning OMO off would NOT have fixed this and WOULD have broken the
default model. personal.json defaults to litellm/agent/atlas-glm-5.3, and
that alias does not exist in LiteLLM -- measured, it returns 400, while
local/librarian returns 200. The agent/* names live only in the opencode
config and the OMO plugin rewrites them at request time. Disabling OMO needs
`model`/`small_model` repointed in the same change. `"plugin": []` in the
base does not disable it either; the profile wins on that key.

Applies to mainframe and sctfw004 only -- system76 and nas link no opencode
config at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9UH1zGZZtA9yhohmQrcT6

meta/hosts/mainframe.conf.yaml

@@ -20,6 +20,7 @@
     ~/.ssh/config.local:    hosts/mainframe/ssh/config.local
     ~/.config/git/identity:     hosts/mainframe/git/identity
     ~/.config/paru:             common/paru
+    ~/.config/opencode/opencode.json:    common/opencode/opencode.json
     ~/.config/opencode/personal.json:    common/opencode/personal.json
     ~/.config/opencode/work.json:        common/opencode/work.json
     ~/.config/opencode/work-strict.json: common/opencode/work-strict.json

meta/hosts/sctfw004.conf.yaml

@@ -46,6 +46,7 @@
     ~/.config/qutebrowser:   common/qutebrowser
     ~/.config/networkmanager-dmenu: common/networkmanager-dmenu
     ~/.julia/config/startup.jl: common/startup.jl
+    ~/.config/opencode/opencode.json:    common/opencode/opencode.json
     ~/.config/opencode/personal.json:    common/opencode/personal.json
     ~/.config/opencode/work.json:        common/opencode/work.json
     ~/.config/opencode/work-strict.json: common/opencode/work-strict.json