Unify OpenCode PR review output to a single opencode-agent[bot] comment

[dceoy]

Problem

On PR review runs, OpenCode posted two PR-visible outputs:

1. A GitHub Review / inline review posted by github-actions[bot], caused by /review-pr calling gh api .../pulls/$PR_NUMBER/reviews (with a gh pr comment fallback).
2. A top-level summary comment posted by opencode-agent[bot] from opencode github run.

Change

Unify output to exactly one PR-visible post from opencode-agent[bot]. The orchestrator now returns a single concise markdown review response; opencode github run posts it. github-actions[bot] no longer posts a review.

.opencode/commands/review-pr.md

• Converted /review-pr from a GitHub-posting command into a review-output command.
• Removed gh api -X POST .../reviews, gh pr review, gh pr comment, and the failure fallback that posted a top-level comment.
• Step 6 changed from "inline comment anchoring" to file:line reference validation; unverifiable lines are demoted to file-only references (kept, not dropped).
• Step 7 now returns one concise markdown response; states that opencode github run is responsible for posting as opencode-agent[bot].
• No-finding case returns only No noteworthy issues found. No praise, padding, duplicate summaries, or status logs.
• Preserved: diff gathering (gh pr diff / gh pr view read-only), parallel subagent launch, normalization, dedup, root-cause aggregation, severity grouping.

.opencode/skills/review-pr/SKILL.md

• Aligned with the command behavior; removed gh api, inline-comment, GitHub Review API, and gh pr comment posting sections.
• Added a Review Output Policy: return one final markdown response only; do not call gh api, gh pr review, or gh pr comment; opencode github run posts as opencode-agent[bot].
• Replaced "Inline Comment Anchoring" with "file:line Reference Validation".
• Updated Workflow Integration: the orchestrator returns one review response that OpenCode posts as a single PR comment (not inline review comments).
• Preserved agent orchestration, normalization, filtering, deduplication, and severity grouping.

.github/workflows/opencode.yml

• opencode-review job permissions reduced defensively to pull-requests: read and issues: read (was write); kept contents: read, id-token: write, actions: read. This prevents accidental future github-actions[bot] write-side posting while still allowing PR metadata/diff reads and OpenCode App token exchange.
• opencode-bot job permissions left unchanged (mention-triggered bot workflows may still need write through the OpenCode integration).

README.md

• "Pull Request Reviews" now documents that /review-pr returns a single response posted by opencode-agent[bot] and does not post a GitHub Review or inline comments; required permissions updated to pull-requests: read.

Acceptance criteria

• /review-pr no longer instructs the agent to call GitHub write APIs directly.
• The only PR-visible review output is the final response posted by opencode-agent[bot].
• github-actions[bot] no longer posts an OpenCode PR Review or inline review comments.
• Review content remains concise, deduplicated, and grouped by severity.
• File-specific findings still include actionable file:line references.
• QA passes (prettier, yamllint, shellcheck, zizmor, actionlint, checkov, validate-opencode.sh).

Drafted for review before merge.