feat: add OpenCode plugin hook integration

[jy-tan]

Summary

Adds the fence --opencode-pre-tool-use helper mode and corresponding fence hooks {print,install,uninstall} --opencode subcommands. The companion plugin lives at https://github.com/Use-Tusk/opencode-fence and routes the bash tool's tool.execute.before lifecycle through this helper, so multi-token denies (gh repo create, git push, etc.) get enforced for OpenCode's agent-issued shell calls - the case Fence's path-only runtime exec policy can't catch on macOS.

See: #143

Changes

• New --opencode-pre-tool-use mode (hooks_opencode.go) speaks a flat JSON wire format the plugin decodes; reuses evaluateShellHookRequest for the policy check.
• fence hooks install --opencode edits ~/.config/opencode/opencode.{jsonc,json} to add @use-tusk/opencode-fence to the plugin: [...] array. Probes for an existing .jsonc first (matching OpenCode's load order) and falls back to .json when neither exists.
• JSONC comment preservation via tidwall/sjson byte-level edits when the plugin array already exists; falls back to the structured re-marshal otherwise.
• --force/-y flag on install/uninstall to skip the y/N prompt that fires when the structured-rewrite path would strip JSONC comments.
• docs/agents.md: new OpenCode subsection under Hooks, plus the Claude/Cursor/OpenCode subsection headings.

[cubic-dev-ai]

3 issues found across 10 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cmd/fence/hooks_doc.go">

<violation number="1" location="cmd/fence/hooks_doc.go:60">
P3: The JSONC comment detector also flags trailing commas, so the comment-loss warning can fire for files that contain no comments.</violation>
</file>

<file name="cmd/fence/hooks_jsonc_edit.go">

<violation number="1" location="cmd/fence/hooks_jsonc_edit.go:102">
P2: Uninstall byte-edit removes only the first matching plugin entry, so duplicate plugin entries can leave OpenCode still configured after a successful uninstall.</violation>
</file>

<file name="docs/agents.md">

<violation number="1" location="docs/agents.md:136">
P3: Document both OpenCode config filenames here. The installer prefers an existing `opencode.jsonc` before `opencode.json`, so this line points readers only at the fallback file.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}