chore: upgrade OpenCode supervision to 1.18.21

[leoncheng57]

Summary

• audit the live OpenCode 1.18.21 classic API and update the expected version across runtime, tests, and docs
• make the combined dev health check safe on stock macOS Bash 3.2, with secured and unsecured regression coverage
• add generated, user-specific BFF LaunchAgent management on a dedicated production port
• keep the optional OpenCode unit direct-binary-only, secret-free, and visibly unresolved until every required absolute value is supplied
• validate Node, paths, builds, logs, launchctl state, plist escaping, and unresolved executable placeholders

Verification

• npm test (171 passed)
• npm run typecheck
• npm run build
• npm run test:e2e (121 passed)
• generated BFF and optional OpenCode plists validated with plutil -lint
• live 1.18.21 audit: 162 paths, 188 operations, 472 schemas