OpenCode 1.18.33 pin (opencode_cli) — supersedes 1.18.32 #664

Problem

OpenCode released 1.18.33 on 2026-09-28; the exact-version gate
(merged as #613 at 1.18.32) refuses it, so latest-version users get
no semantic scans until the pin moves. The upstream delta
(.32 → .33) is policy-irrelevant on its face — Cloudflare gateway
timeouts, MCP browser-launch failure reporting, debug-config
redaction, Gemini thinking defaults — but the deny-all contract
requires live re-verification per release regardless (see PR #665).

Proposed scope

Pin bump only, no code or policy changes:
_OPENCODE_SUPPORTED_VERSION 1.18.32 → 1.18.33 plus all version
references (comments, fixtures, README pin note, DEVELOPMENT),
with live evidence on the real binary: run --help flag diff,
nonce probe with exact echo, and _preflight_opencode_policy
against the real 1.18.33 (version gate + all 12 sensitive settings

• agent deny; needs no auth or inference).

Acceptance

• Pin and every non-historical reference read 1.18.33; rejection
  fixtures still fake versions outside both pins.
• Live evidence recorded in the PR: identical flag surface,
  unchanged envelope shapes, preflight PASS on the real binary.
• Full provider-path inference remains out of scope (blocked by
  the pre-existing isolation × auth limitation, tracked
  separately).