fix(opencode): profile instructions fail before model call under write-jail

[drewstone]

Problem

OpenCode exits before the model call when AgentProfile instructions are materialized under the host write jail.

Reproduction

1. Run current CLI Bridge commit 4176081 with BRIDGE_BACKENDS=opencode, OPENCODE_EXECUTOR=host, and BRIDGE_JAIL_MODE=write-jail.
2. Send an OpenCode turn with a temporary project as cwd and an AgentProfile that contains prompt.instructions.
3. The profile materializer creates .opencode/profile-instructions.md and opencode.json.
4. OpenCode exits 1 before any model usage.

Observed bridge error:

opencode exited 1: Error: Unexpected error
Unknown: FileSystem.writeFile (<workspace>/.opencode/.gitignore)

The receipt reports the requested instructions as supported and materialized, but the run returns zero calls and zero tokens.

Expected

OpenCode profile materialization and the write jail must compose. The runner should be able to initialize its generated config without making the tracked project writable.

A durable fix could place generated OpenCode state in the writable scratch tree, pre-materialize every required generated file, or mount only the generated config area writable. It must not weaken the project read-only boundary silently.

Product impact

A valid Braid AgentProfile with instructions fails through CLI Bridge before model execution. Removing prompt.instructions avoids this specific failure, so the profile dimension is the trigger.

[drewstone]

Checked against current main (0076bfe): not fixed — this stays open. The recent jail work is adjacent to this defect, not on it.

The exact path this issue names is still read-only for the jailed CLI under write-jail:

• The materializer pinned on main (@tangle-network/agent-profile-materialize@0.14.2, package.json:28) still routes opencode instructions through the project tree: .opencode/profile-instructions.md, plus agents/commands/tools under <cwd>/.opencode/....
• provisionProfileWorkspace applies that plan into the request cwd from the unjailed bridge process (src/backends/profile-support.ts:122), so materialization itself succeeds — exactly as reported.
• Under write-jail the spawned CLI then gets the project dir read-only: src/jail/linux-bwrap.ts:148-150 (--ro-bind spec.projectDir), with writes confined to <cwd>/.agent-home scratch (src/jail/resolve-spec.ts:58-72, root bound writable at linux-bwrap.ts:164). OpenCode's startup write of <workspace>/.opencode/.gitignore still fails exactly as the report shows.

One nuance worth knowing: the failure is now write-jail-specific. Under the stronger fs-jail, the workspace is deliberately re-exposed read-write after the tmpfs (src/jail/linux-bwrap.ts:139), so the .opencode/.gitignore write succeeds there.

What did land nearby, for the record: #154 seeds a writable opencode XDG data home with auth.json (src/jail/auth-preserve.ts:123-130), and #164 exposes the opencode install root read-only inside the fs-jail (src/backends/opencode.ts:116-123). Neither touches the workspace .opencode write.

Durable-fix options remain as reported: pre-materialize every generated file OpenCode writes at startup (including .opencode/.gitignore), route generated opencode state into the writable scratch tree, or add <cwd>/.opencode to extraWritablePaths (src/jail/types.ts:27, bound at linux-bwrap.ts:160-161) for opencode runs carrying a profile — the last option widens the project read-only boundary for that directory, so it needs an explicit decision rather than a silent default.