test(plugin): guard scoped OpenCode context injection

[kunickiaj]

Description

Adds tests proving the OpenCode plugin's `experimental.chat.system.transform` injection path cannot serve cross-scope memories. Two coverage paths:

1. Plugin-level: each transform call recomputes (no in-process cache that could leak stale cross-scope content) and threads scope identity through to the CLI pack helper.
2. Real CLI pack transform: the actual binary path is exercised so injected system prompt is verified to contain only memories from the resolving scope.

Plugin tests resolve `@codemem/core` to workspace source via a vitest config alias so the test runs against the real implementation.

Decomposed from codemem-ov4g.5.3 → ov4g.5.9.

Type of Change

• 🧪 Testing (test-only changes)

Testing

• Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test`)
• Added/updated tests for changes
• Manually verified changes work as expected

Checklist

• Code follows project style (`pnpm run lint` passes for touched files)
• Self-review completed
• Documentation updated (if needed)
• No new warnings introduced

[kunickiaj]

• test(core): add retrieval leakage regression suite #1038
• fix(core): enforce scope-aware export import #1037
• fix(api): enforce scope-safe viewer and CLI memory access #1036
• fix(mcp): enforce scope-safe memory tools #1035
• test(plugin): guard scoped OpenCode context injection #1034 👈 (View in Graphite)
• fix(core): harden memory pack scope assembly #1033
• fix(core): scope sqlite-vec semantic retrieval #1032
• fix(core): enforce scope visibility in memory retrieval #1031
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[kunickiaj]

Merge activity

• May 5, 2:59 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 5, 3:09 PM UTC: Graphite rebased this pull request as part of a merge.
• May 5, 3:10 PM UTC: @kunickiaj merged this pull request with Graphite.