chore(opencode): bump chart to 0.5.1

[makeitworkbot]

Summary

Select published opencode-server chart 0.5.1 from charts PR #125. Update the existing exact chart-pin/protocol-selector assertion to (0.5.1, 2); the selector remains 2 and the guard is not weakened. Only workloads/apps/opencode-app.yaml and .github/workflows/test.yml change.

Type of change

• GitOps desired state
• CI / reusable workflow (one existing assertion literal; events/actions/permissions unchanged)

Validation

• Required pull-request checks pass
• Generated version pin originates from the canonical charts publisher

Producer main run 37281331086 passed. The publish log confirms ghcr.io/makeitworkcloud/charts/opencode-server:0.5.1, digest sha256:14f09b041cbb4abce60959878cf5e08f75c6945142e4db4cfcb1ce800944a0ff. Consumer checks are required at d225a7ee.

Independent adversarial, security, and DevOps reviews ADVANCE for the complete two-line diff; release review identified publication and consumer-CI gates, not a content defect. Publication is verified; remaining consumer checks must complete before merge. No local validation ran.

Impact and rollout

Owner explicitly authorized merge and rollout after readiness checks. Generated auto-merge remains enabled and protected checks gate it. Main CI then requests root reconciliation; verify gitops-workloads, child opencode, new pod readiness, unchanged OpenCode 2.0.22 image, and delivered prompt bytes separately. The existing Recreate rollout briefly interrupts service. Default selection, PVCs, Secrets, exporter protocol/checksum, uploader 0.2.0, and networking are unchanged. Rollback is a reviewed previous immutable chart pin plus matching assertion, not a live patch.

Prompt delivery and health do not prove retrieval adherence. The waived diagnostic remains stopped; reusable behavioral evaluation is deferred.

Safety and secrets

• No plaintext secrets, decrypted SOPS data, state, credentials, kubeconfigs, or private KB content
• No local OpenTofu operations
• Effects and rollback described above

Materially AI-authored assertion adjustment; version pin is publisher-generated.