feat: show OpenCode Go subscription rate limits on Mac and iPhone

[cte13]

What

Shows the OpenCode Go plan's usage limits (5-hour rolling / weekly / monthly percentages with reset countdowns) everywhere the Claude/Codex limits already appear:

• macOS popover — OpenCode tab gets a "Limits (official)" section with three rows, a red "Limit reached" badge when a window reports rate-limited, and the shared 15-min stale badge
• Menu bar — OpenCode 41% line (max of the three windows), gated on OpenCode usage today like Claude/Codex
• iPhone app — Go 5h / Go Weekly / Go Monthly rows in the LimitsCard, with real reset dates (unlike the flattened Codex rows)
• Warnings/notifications/bubble alerts, highestLimitUtilization, candy-eligible windows, and limitsReady all include the new windows

How

Official endpoint GET https://opencode.ai/zen/go/v1/usage (shipped upstream 2026-08-11, anomalyco/opencode#16513), authenticated with the opencode-go key already on disk in ~/.local/share/opencode/auth.json — no browser cookies, no workspace ID. Verified live against production during development.

Implementation notes:

• OpenCodeGoLimitsProvider reuses LocalAdditionalUsageReader.defaultOpenCodeRoots (so OPENCODE_DATA_DIR just works) and sends an explicit User-Agent: PokeTokenBar/<version> — the server 403s default tool UAs (reproduced with Python-urllib; regression-tested)
• Polling is throttled to one attempt per 5 minutes (success or failure): the endpoint is a 3-table join with no cache headers or documented poll interval, and the default refresh cycle is 2 minutes
• 401/403 (unknown key / no Go subscription) and network failures keep the previous value and just hide the section — same contract as Codex limits
• 403-vs-UA distinction: a 403 with a valid key means "no subscription"; the UA block was a separate 403 that a custom header fixes

Test hermeticity fix (found by the suite)

Adding a third limits provider to UsageStore.init made every existing test construction that runs refresh() without stubbing it hit the live network with the developer's real API key — RareCandyGrantIntegrationTests failed with live data leaking into candy windows. Beyond stubbing the affected sites (Grok/RareCandy/UsageStoreTests), the real provider is now gated on AppEnv.isBundledApp (same single gate as notifications/keychain/production logs) so swift test can never make this class of call by construction. PTB_PARITY=1 unlocks a live endpoint smoke test (testLiveOpenCodeGoUsageEndpoint) for schema-drift detection.

The env-guard test needed AppEnv allowlisted for the new PTB_PARITY flag read (AppEnv.isParityRun) — same QA-flag category as CompanionStore's PTB_STATE_DIR.

Verification

• swift test: 751 tests, only the documented pre-existing testHermesAcceptsMillisecondStartedAt timezone failure (fails identically on main)
• 16 new tests: payload decoding (real production fixture incl. rate-limited window + empty windows), auth.json key parsing, request headers, menu line gating, warning state, highest-utilization gating, candy windows, poll throttle, failure handling, phone payload backward/forward compatibility
• llvm-cov --show-regions: zero ^0 regions in the new provider, models, and all touched UsageStore branches
• PTB_PARITY=1 live check: rolling=72 weekly=69 monthly=34 decoded correctly end-to-end
• Both Xcode targets (PokeTokenBar macOS, PokeTokenBariOS simulator) build

The widget intentionally keeps its curated compact limit set (no Opus/Sonnet/Codex-2nd either) — can extend later if wanted.