C2: Port the plugin runtime to the v2 Effect-first plugin API

[diegohb]

Closes #25 (C2, child of spec #23)

What

Ports the plugin runtime from the v1 @opencode-ai/plugin factory to the opencode v2 Effect-first plugin API, per the C1 verified-facts record (docs/reference/opencode-v2-facts.md, pinned to anomalyco/opencode v2.0.23).

• Definition: default export is now a v2 plugin definition { id: "opencode-architect", effect } built with Plugin.define from @opencode/plugin/effect (facts §1–2). The v1 factory, its types, and the config hook are gone.
• Agents: registered through ctx.agent.transform + editor.update upserts (system, description, mode, permissions), mirroring the pinned first-party exemplar core/src/config/plugin/agent.ts.
• Permissions: the external-directory allow migrates to v2 semantics — a ctx.permission.hook("evaluate") decision that upgrades a pending ask to allow only for external_directory resources inside the bundled assets directory. Explicit config denies are final under v2 and never reach the hook, preserving the old deny-wins behavior.
• Frontmatter translation: prompt → system; the tools boolean map and permission keyed record become a v2 permission ruleset using the pinned normalizeAction renames (write/patch → edit, task → subagent, bash → shell) (facts §4–6).
• Preserved invariants: prompt path rewriting untouched; at-most-once advisories with separate guards; startup non-interference — a failed load degrades to the single stale-cache advisory and skips the not-installed advisory, matching v1 ordering; successful activations advise once and stay suppressed.
• Dependencies: @opencode/plugin@2.0.23 + effect@4.0.0-rc.112 pinned (C1 adjudication; 2.0.24 was latest at execution — flagged, not adopted per spec). @opencode-ai/plugin and @opencode-ai/sdk removed. Consumer-facing templates declare @opencode/plugin and effect at @latest so generated packages resolve current versions at time of use — policy recorded in facts §15 for C5–C7.

Acceptance criteria (all verified at 8670c4b)

• Plugin loads under a v2 host and registers all ten agents — activation harness registers exactly 10 agents with non-empty system and valid mode; host-level load smoke lands with C4's harness per the spec's ticket split
• Permission registration works under v2 semantics — nine decision-table tests on the evaluate hook
• Prompt path rewriting and advisories behave as before
• No v1 plugin API usage remains in the runtime — zero @opencode-ai/* in src/
• Typecheck and migrated test suite green — tsc --noEmit clean; migrated tests 23/23; full suite 143 pass with only the 5 failures that pre-exist on the base commit (Windows-only environment artifacts in tarball/cache tests; CI runs ubuntu)

Evidence: issue comment

Test plan

• bun run check (tsc --noEmit)
• bun test — baseline diff vs fbbaed8 shows no new failures
• CI on ubuntu (this PR)

Out of scope (owned by sibling tickets)

• Installer/config machinery v2-native registrations (C3, C3: Migrate installer and config machinery to v2-native registrations #26)
• Verification harness with the real v2 host in CI (C4, C4: Verification harness — v2 host smoke test and schema validation in CI #27)
• Guidance/templates/code rewrite to v2 facts (C5–C7); their v1-era strings remain until those tickets land