Bind OpenCode native sessions to OrgX context

[hopeatina]

Scope

• move execution onto the official OpenCode v2 SDK session, event, prompt, diff, and abort seams
• validate the strict OrgX activation wrapper and both canonical SHA-256 digests before native session creation
• require durable Gateway acceptance before prompting or emitting Work Graph start
• bind exact workspace lineage, native session, cwd, provider, streamed parts, terminal parts, and terminal receipt
• add bounded reconnect, cancellation, privacy, redirect, and stale-authority handling
• report provider auth as user_managed and release alpha.15

Verification

• focused protocol suite: 42/42
• full Vitest suite: 11 files, 106/106
• Node contract tests: 8/8
• typecheck
• build
• git diff --check
• clean tarball install with SSH disabled; plugin alpha.15 and Gateway SDK alpha.10 resolved over pinned public HTTPS
• core golden fixture byte-identical; context and activation digests match

Rollout

Publishing, installed-daemon proof, and the live Gateway acceptance canary remain separate post-merge gates.