chore(opencode-sandbox): add SSH config, git safe directory, and test setup

.opencode-sandbox/Dockerfile

@@ -10,6 +10,10 @@ RUN pacman -Syu --noconfirm && \
       opencode \
     && pacman -Scc --noconfirm
 
+# Git safe directory system-wide config
+RUN git config --system --add safe.directory /workspace
+RUN git config --system --add safe.directory '*'
+
 # Firewall script — blocks everything except your Gitea instance
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh