fix(opencode): grant opentui grammar cache

[NoRiceToday]

Issue: Closes #244

What

• Restores OpenCode markdown rendering outside $HOME, including first-use grammar cache setup under default and custom XDG data roots.

Why

• OpenTUI caches tree-sitter grammars outside OpenCode’s existing sandbox grants, so rendering silently fell back to raw text.

How

• Resolve OpenTUI’s cache from $XDG_DATA_HOME, falling back to ~/.local/share/opentui.
• Create the cache before start and serve grant resolution, then grant it read/write only for OpenCode.
• Enforce that pre-created directories are also sandbox-granted and document the new grant.

Verification

• go test -buildvcs=false ./... -skip ^TestIntegration -count=1 — pass
• go build -buildvcs=false ./... — pass
• go vet ./internal/config ./internal/cli ./internal/sandboxprofile — pass
• go test -buildvcs=false -tags=e2e ./internal/e2e -run ^$ -count=1 — pass (compile check)
• git diff --check — pass

Follow-up

• Full macOS kernel-sandbox integration is covered by CI; nested local Seatbelt application is denied by the active sandbox.

🤖 Generated with OpenCode (GPT-5.6 Sol).

[nhuelstng]

Should fix : test escapes the temp home when XDG_DATA_HOME is set. TestLaunchOpenCodeCreatesAndGrantsRuntimeDirs (internal/cli/continue_resume_test.go:266) doesn't neutralize an ambient XDG_DATA_HOME. I verified: with XDG_DATA_HOME=/some/dir the test fails and prepareSandboxDirs creates /some/dir/opentui on the developer's real machine. The sibling tests in serve_test.go/harness_test.go do t.Setenv("XDG_DATA_HOME", ""); launchCacheCaptureForHarness needs the same (or point it under home).