fix: avoid opencode runtime apk install

scripts/gitops-render.mjs

@@ -5847,7 +5847,7 @@ function opencodeServerManifest({ profile = "v03", source, deploy = null, catalo
                 image: "ghcr.io/anomalyco/opencode:1.17.7",
                 imagePullPolicy: "IfNotPresent",
                 command: ["/bin/sh", "-ec"],
-                args: ["if ! command -v git >/dev/null 2>&1; then\n  n=1\n  until timeout 180s apk add --no-cache git; do\n    if [ \"$n\" -ge 3 ]; then exit 1; fi\n    n=$((n + 1))\n    sleep 5\n  done\nfi\nexec opencode serve --hostname 0.0.0.0 --port 4096"],
+                args: ["exec opencode serve --hostname 0.0.0.0 --port 4096"],
                 workingDir: "/workspace",
                 env: [
                   { name: "HOME", value: "/workspace" },

scripts/gitops-render.test.ts

@@ -763,7 +763,8 @@ test("v03 render includes D518 secret-plane smoke on D518 gitops root", async ()
     assert.match(opencodeDeployment.spec?.template?.metadata?.annotations?.["hwlab.pikastech.local/opencode-config-sha256"] ?? "", /^[a-f0-9]{64}$/u);
     const opencodeContainer = collectContainersFromItem(opencodeDeployment).find((container) => container.name === "opencode-server");
     assert.deepEqual(opencodeContainer?.command, ["/bin/sh", "-ec"]);
-    assert.match(opencodeContainer?.args?.[0] ?? "", /timeout 180s apk add --no-cache git/u);
+    assert.equal(opencodeContainer?.args?.[0], "exec opencode serve --hostname 0.0.0.0 --port 4096");
+    assert.doesNotMatch(opencodeContainer?.args?.[0] ?? "", /apk add|dl-cdn\.alpinelinux\.org/u, "opencode startup must not depend on runtime apk repository access");
     const opencodeEnvEntries = new Map((opencodeContainer?.env ?? []).map((entry) => [entry.name, entry]));
     assert.equal(opencodeEnvEntries.get("HTTPS_PROXY")?.value, "http://sub2api-egress-proxy.platform-infra.svc.cluster.local:10808");
     assert.match(opencodeEnvEntries.get("NO_PROXY")?.value ?? "", /\.svc\.cluster\.local/u);