fix(opencode): standardize primary cache bootstrap and compact worker routing

[xnoto]

Summary

Release opencode-server 0.5.3 for the owner-approved cache-first policy clarification. All ten primary agents carry the same complete Repository source retrieval block, including active SHA-pinned GitHub bootstrap of missing canonical writer/reader mapping evidence before ordinary reads fall back. Keep xnoto aliases and knowledge scopes separate. Shared AGENTS.md retains universal safety and a compact subagent evidence-consumption contract; workers report missing evidence to the primary instead of bootstrapping or reindexing.

Type of change

• Bug fix
• GitOps desired state (packaged chart policy)
• CI / reusable workflow (existing test assertions only)
• Documentation

Validation

• Required pull-request checks pass

PR CI run 37349271935 succeeded at 56ea7813: test, detect, and package opencode-server. Publication and rollout remain separate pending stages.

• Packaged files remain canonical chart-owned sources; existing archive/render parity remains enforced

Adversarial and infrastructure-security reviews ADVANCE; bounded CI/delivery DevOps review ADVANCE; QA COVERED; release READY at 56ea7813. The release reviewer found a Makefile dollar-escaping defect in the initial commit; the follow-up corrects it before PR creation. No unresolved Critical/High finding and no waiver needed. CI must run repository hygiene, Helm lint/render, common-block identity/bootstrap and floor-size tests, strict role-tail/universal-floor preservation, and archive-byte parity. No local validation ran. Static tests do not prove future agent adherence; the previously waived synthetic diagnostic is not resumed.

Impact and rollout

Owner approved implementation, merge, publication, and rollout. Sixteen files change: ten primary prompts, shared floor, Chart.yaml, Makefile, existing Python render/policy test, architecture guide, and chart README. Image/appVersion 2.0.22, API version 2, models, permissions, pilot, PVCs, Secrets, networking, and production ConfigMap server-side apply remain unchanged.

After passing PR CI, merge automatically validates/publishes immutable GHCR chart 0.5.3 and generates the separate cluster pin PR. The primary must update that PR's existing exact chart/API selector assertion to (0.5.3, 2) without weakening it, review the two-line consumer diff, and require cluster checks before merge. Verify producer publication/artifact, selected GitOps revision, root/child reconciliation, replacement pod readiness, and delivered instruction-byte identity separately. Existing Recreate strategy causes brief downtime. No manual live patch or sync is planned.

Rollback selects published 0.5.2 and its matching consuming assertion through reviewed GitOps; never overwrite an immutable chart. Functional policy adherence remains unknown.

Safety and secrets

• No plaintext secrets, decrypted values, state, credentials, kubeconfigs, private records, or sensitive live payloads
• No local OpenTofu operations were run or claimed
• Effects and rollback described above

Materially AI-authored. Organization default PR template applied.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.