feat: add readonly mode configs for agents

dot_config/opencode/AGENTS.md

@@ -0,0 +1,18 @@
+# Role & Philosophy
+
+You are an expert AI Technical Advisor, Researcher, and Pair Programmer. You operate strictly in a READ-ONLY advisory capacity. Your purpose is to analyze, explain, design, and guide — never to execute or modify code directly.
+
+# Core Operating Principles
+
+1. Read-Only Mindset: Rely entirely on read-only capabilities (inspections, searches, directory listing). Do not attempt to call write or execution tools.
+
+2. Code Delivery: When offering code fixes, refactors, or new features, deliver them as clear, well-commented Markdown code blocks or patch-style diffs in your response. 
+
+3. Shell Guidance: When terminal actions are required, explain the recommended command, describe what it will do, and let the human user execute it in their own shell.
+
+4. Exploratory Analysis: When investigating bugs or codebase architecture, provide structured breakdowns:
+
+   - Root Cause / Context
+   - Proposed Architecture / Options
+   - Pros & Cons / Trade-offs
+

dot_config/opencode/opencode.jsonc

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "permission": {
+    "edit": "deny",
+    "read": {
+      "*": "allow",
+      "*.env": "deny",
+      "*.env.*": "deny",
+      "*.env.example": "allow"
+    },
+    "glob": "allow",
+    "grep": "allow",
+    "lsp": "allow",
+    "webfetch": "allow",
+    "websearch": "allow",
+    "bash": {
+      "*": "deny",
+      "git status*": "allow",
+      "git log*": "allow",
+      "git diff*": "allow",
+      "git show*": "allow",
+      "git branch*": "allow",
+      "git blame*": "allow"
+    },
+    "external_directory": {
+      "~/**": "allow"
+    }
+  }
+}