feat(sandbox): inject an always-on sandbox briefing into the harness

[NoRiceToday]

Problem

An agent launched inside the omac sandbox has no idea it's sandboxed. When it
hits a denied filesystem path or a blocked network host, it misreads the failure
as a bug in its own code, retries it pointlessly, or tries to "self-authorize"
by flipping its harness's own permission/sandbox settings — which does nothing,
because omac enforces the sandbox at the kernel level (Seatbelt / bubblewrap +
Landlock) before the harness ever starts. Nothing told the agent, up front,
that it runs under omac, that a blocked operation is policy rather than a bug,
and that changing the rules is the user's job, not the agent's.

This PR gives every sandboxed launch an always-on briefing, injected into the
harness's system prompt, so the agent begins already knowing the ground rules.

Context

• The briefing text lives in exactly one place — internal/sandboxbrief/brief.md
  — and is embedded into the binary, so it ships with omac and is edited from a
  single source.
• omac's two harnesses expose different system-prompt surfaces: Claude Code
  takes a CLI flag (--append-system-prompt); OpenCode has no such flag and
  instead receives context through its bridge plugin. The injection path forks
  accordingly.
• Injection is deliberately conservative: it fires only when a real sandbox
  wraps the inner command and that command is the harness's own agent binary,
  so the briefing never lands on an --inner-overridden or no-sandbox-debug
  bash process.

Changes Overview

• internal/sandboxbrief (new) — embedded brief.md plus Default() and
  Resolve(override) (any override text wins; empty/whitespace falls back to the
  embedded default).
• internal/config — optional sandbox.briefing override field;
  Harness.SystemContextArgs adapter (Claude → --append-system-prompt,
  OpenCode → nil), mirroring the existing ResumeByIDArgs func-field pattern.
• internal/cli/briefing.go — briefingInjection(...) gate that decides
  whether (and with what text) to inject for a given launch.
• internal/cli/start.go + serve.go — wire the gate into both launch
  paths: Claude via the flag, OpenCode via the OMAC_SANDBOX_BRIEFING env var.
• OpenCode plugin (.opencode/plugins/omac-multidir.ts and the embedded
  internal/plugin/assets copy) — push OMAC_SANDBOX_BRIEFING into the system
  prompt; inert outside omac, purely additive, never touches user config.
• internal/cli/setup.go — ensureOpenCodePlugin auto-provisions the
  OpenCode bridge plugin globally on launch, so the relay works even if the user
  never ran omac plugin install.

Diagram

flowchart TD
  A["omac start / omac serve"] --> B["briefingInjection(noSandbox, inner, harness, override)"]
  B -->|"no sandbox, empty inner,<br/>or inner ≠ harness agent binary"| X["skip — no briefing"]
  B -->|"sandboxed launch of<br/>the harness's own binary"| C["sandboxbrief.Resolve(override)"]
  C --> D{harness}
  D -->|Claude| E["SystemContextArgs →<br/>--append-system-prompt &lt;brief&gt;"]
  D -->|OpenCode| F["env OMAC_SANDBOX_BRIEFING=&lt;brief&gt;"]
  F --> G["bridge plugin pushes it into<br/>output.system (system prompt)"]
  E --> H["agent starts already knowing<br/>it's in the omac sandbox"]
  G --> H

Loading

Deployment / Impact

• Purely additive and environment-gated. Outside omac nothing sets
  OMAC_SANDBOX_BRIEFING, so the OpenCode plugin branch is inert; the Claude
  flag is appended only on a sandboxed agent launch. No breaking changes to the
  config schema or CLI.
• New optional sandbox.briefing config key; absent/empty uses the embedded
  default.
• omac start / serve now write the OpenCode bridge plugin into
  ~/.config/opencode/plugins on launch — idempotent, refuses to clobber a
  foreign same-named file, and any failure is a warning, never a launch blocker.

Testing

• New unit tests: sandboxbrief (default non-empty, override vs. fallback),
  the briefingInjection gate (active for the agent binary; skipped for
  no-sandbox / non-harness-binary / empty-inner), SystemContextArgs (Claude
  flag builder, OpenCode nil), sandbox.briefing YAML parsing, and the
  non-OpenCode ensureOpenCodePlugin no-op.
• go build ./..., go vet, and go test on the changed packages
  (internal/cli, internal/config, internal/sandboxbrief) all pass locally
  (Go 1.25).
• Verified end-to-end on macOS for both harnesses: the briefing reaches the
  system prompt for Claude (via --append-system-prompt) and OpenCode (via the
  bridge plugin). Linux verification still needed — someone on Linux
  (bubblewrap + Landlock) should confirm the same end-to-end behavior.