fix(testing): repair OpenCode OneCLI qualification setup

[danshapiro]

Summary

• Use the typed OneCLI OpenCode auth-file grant for isolated runtime qualification, and reject missing, linked, unreadable, or non-private grants early.
• Remove the legacy raw auth-file bootstrap path, use the self-contained native-history probe in the runtime container, and bind the test server for container access.
• Check staged auth and model availability before the first provider turn; report an OpenAI token-refresh 401 promptly instead of waiting for the native-response timeout.
• Declare the missing esbuild dependency required by the MCP runtime image build.

Verification

• pnpm run test — passed: Cloud Vitest, source-runtime, Rust workspace, and Electron phases.
• pnpm run typecheck — passed.
• Focused Vitest — 3 files, 25 tests passed.
• GPT-family review — no blocking code issues found.

Live OpenCode certification remains unverified: the available auth file returns HTTP 401 during token refresh, and OneCLI has no grant for its stored OAuth credential. No live qualification receipt is claimed by this PR.