fix(opencode): reject stale patch sources after approval

[gary23w]

Issue for this PR

Fixes #31776. This remains reproducible on dev at d6855b6; the previously cited #31893 closed unmerged and did not change apply_patch.ts.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

If a source file changes while patch approval is pending, apply_patch currently overwrites or deletes the newer content. It now retains the original bytes and rechecks every update/delete/move source after approval, before applying any file changes. A mismatch or missing source rejects the patch with a path and retry guidance.

This adapts nl-veil's validate-all-before-mutation principle. Commit remains sequential; this does not add rollback or eliminate races after preflight.

How did you verify your code works?

On Windows with Bun 1.3.14:

• Regression tests change a later source inside the approval callback and assert earlier files remain untouched. Cases cover update/delete/move, disappearance, BOM changes, and malformed UTF-8 bytes. The original update/delete/move/BOM regressions all fail on the base implementation.
• From packages/opencode: bun test --timeout 30000 test/tool/apply_patch.test.ts test/tool/edit.test.ts test/tool/write.test.ts — 78 passed.
• bun typecheck passes; Prettier passes. Changed-file lint has zero errors and four existing warnings.

Screenshots / recordings

Not applicable; no UI changes.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR