roles: refuse a metered OpenCode seat the roles file's allow list does not name

[creedants]

roles.py write now refuses a seat on a metered OpenCode model unless the roles file's allow list names it.

• The allow list is opencodeAllow in the roles file. --allow-opencode <model id> adds a model and --deny-opencode <model id> removes one. Nothing else changes the list. --keep keeps it, and a write that passes neither flag keeps it.
• A write that would leave an unlisted metered OpenCode seat in the file, including one kept by --keep, exits 2, names the seat, the model, and the flag, and writes nothing. --force still writes the seat and does not add it to the list.
• show, backup, and validate resolve an existing file as before and add one note for each such seat. They never refuse and never rewrite the file. backup --role verifiers adds the note for the seats of the review backups panel it returns.
• A model is free only when its catalog entry has cost, pricing, or tier and every one present is the number 0 or the string free. Anything else is metered, including a model the catalog says nothing about.
• A provider is OpenCode when its driverKind is opencode, or when it has no driverKind and its id is opencode or opencode-go.
• Seats on other providers are untouched.

Known limits:

• T3's catalog gives OpenCode models no cost fields today, so every OpenCode model counts as metered until it is allowed, including the free ones.
• The user file's list and a project file's list are separate.
• An inherit seat is not checked.
• An OpenCode provider under another id with no driverKind is not recognized.

Reviewed at e9a670a0.