chore: sync upstream anomalyco/opencode dev (10 commits)

[nickhou1983]

同步上游

将本 fork 的 dev 与上游 anomalyco/opencode 同步，合并 10 个新提交（HEAD 对齐上游 4438f69）。

同步进来的提交：

• 4438f69 zen: add security check
• 76ced54 chore: generate
• c40e3e7 zen: add security check
• 0317531 zen: add laguna-2-2.1
• 5f241f1 chore: generate
• b513faf fix(app): support nested slash command autocomplete (fix(app): support nested slash command autocomplete anomalyco/opencode#38097)
• 21c4c93 fix(ui): improve progress circle contrast (fix(ui): improve progress circle contrast anomalyco/opencode#38101)
• abc4b83 Zen: gemini 3.6 flash and 3.5 flash lite
• cb562b2 chore: generate
• 2d2339d feat(app): draggable project rows (feat(app): draggable project rows anomalyco/opencode#38055)

因 fork 的 dev 采用 merge 历史与上游分叉，无法 fast-forward gh repo sync，故以合并方式同步。

附带分析

本次同步后已对 opencode 发送给 GitHub Copilot 的请求（鉴权/Token 交换、Request Header、Request Body）做只读分析，报告见 Issue #13。

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.