test(agents): opencode answers only through the idx tools

opencode kept its built-in tools, so it could route around the server
under test: on published 0.3.1 it answered a quote from web search, and
on the live `changes` case it queried the ownership SQLite file with
bash and timed out. Deny every tool but `idx_*`, as Claude, pi, and
Hermes already are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

docs/SMOKE.md

@@ -106,8 +106,9 @@ each run keeps a copy next to its output as `<case>.<run>.mcp-stderr`.
   output but still deletes every copied agent config.
 - Tools are auto-approved for the run (Claude `dontAsk` with
   `mcp__idx__*`, Codex `default_tools_approval_mode="approve"`); Claude and pi
-  also get no built-in tools, and Hermes only the `idx` toolset, so they
+  also get no built-in tools, Hermes only the `idx` toolset, and opencode a
-  can only answer through MCP.
+  permission that denies everything but `idx_*`, so they can only answer
+  through MCP.
 - `IDX_AGENT_MODEL_<AGENT>` picks a model (for example
   `IDX_AGENT_MODEL_CLAUDE=sonnet`). `IDX_AGENT_EXEC_PREFIX` prefixes every
   agent command, for hosts that inject API keys through a wrapper.

tests/agents/agent-smoke.sh

@@ -276,7 +276,8 @@ setup_opencode() {
     mkdir -p "$work/opencode/cwd"
     jq -n --argjson s "$server_json" \
         '{"$schema": "https://opencode.ai/config.json",
-          mcp: {idx: {type: "local", command: ([$s.command] + $s.args), environment: $s.env, enabled: true}}}' \
+          mcp: {idx: {type: "local", command: ([$s.command] + $s.args), environment: $s.env, enabled: true}},
+          permission: {"*": "deny", "idx_*": "allow"}}' \
         > "$work/opencode/cwd/opencode.json"
 }
 run_opencode() {