feat: client sync core — config, pull, inventory, manifest, OpenCode target

- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
  token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
  config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
  never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
  deterministic bytes; folder hashes over sorted relpath+filehash lines so
  tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
  both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
  is a byte-level no-op

internal/target/opencode.go

@@ -0,0 +1,41 @@
+// Package target maps content types to runtime-specific deployment paths.
+// The OpenCode target is the thin v2 implementation: a type filter plus
+// path mapping, leaving the door open for future targets.
+package target
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/m3tam3re/agent-lib/internal/lockfile"
+)
+
+// OpenCode maps items into the OpenCode runtime layout, rooted at the
+// user's home directory.
+type OpenCode struct {
+	Home string
+}
+
+// NewOpenCode resolves the home directory once for all path mappings.
+func NewOpenCode() (*OpenCode, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return nil, err
+	}
+	return &OpenCode{Home: home}, nil
+}
+
+// DeployPath returns the absolute destination for an item; ok is false for
+// types this target never deploys (MCP stays under fleet control).
+func (o *OpenCode) DeployPath(typ, name string) (path string, ok bool) {
+	switch typ {
+	case lockfile.TypeSkill:
+		return filepath.Join(o.Home, ".agents", "skills", name), true
+	case lockfile.TypeCommand:
+		return filepath.Join(o.Home, ".config", "opencode", "commands", name+".md"), true
+	case lockfile.TypeAgent:
+		return filepath.Join(o.Home, ".config", "opencode", "agents", name+".md"), true
+	default:
+		return "", false
+	}
+}