fix(opencode2): pin the aisdk package to the plugin's own version

[nkoynov]

The 2.0 inventory registers package: "aisdk:cursor-opencode-provider", and OpenCode resolves a bare npm name as @latest. On 2.0.22 the language model is built from that spec. The built-in opencode.provider.dynamic plugin is registered before external plugins and its sdk hook installs the package itself (anomalyco/opencode#42788), so this plugin's sdk hook returns at if (event.sdk) return. The README troubleshooting row and docs/opencode-2.md already say that 2.0 npm-installs the published package.

As a result, "plugins": ["cursor-opencode-provider@0.8.0"] still runs the latest published language model, and that copy can change whenever OpenCode refreshes its package cache.

This PR registers aisdk:cursor-opencode-provider@<version>:

• The version comes from the package's own package.json, two levels above both src/opencode2/ and dist/opencode2/.
• If that file is missing or names another package, it falls back to the bare name.
• CURSOR_OPENCODE2_DEV_ENTRY still wins.

This is the same fix as stablekernel/opencode-cursor#129. That project inlines the version at build time because its bundle has no package.json next to it. tsc keeps the layout here, so reading the file at runtime works and the build doesn't change.

• Tests: plugin-opencode2.test.ts checks the pinned spec and the fallbacks (missing file, other package, version range).
• Live check (OpenCode 2.0.22 in T3, fresh scratch HOME per build, plugin loaded from the local build, DEV_ENTRY unset, one ping):
  • main installs npm/cursor-opencode-provider@latest/.
  • This branch installs npm/cursor-opencode-provider@0.8.0/.
  • The same branch with package.json set to 0.7.6 installs @0.7.6. Its Runs come from that copy: they log 0.7.6's skills= field.
• CI: the full CI gate passes.
• fix: harden plan approval and fresh-turn handling across hosts #38: this rebases onto fix: harden plan approval and fresh-turn handling across hosts #38 with only a CHANGELOG conflict.

[nkoynov]

Closing this since I no longer need it: I now point OpenCode at a pinned local build of the package, so the @latest lookup never happens on my side. Happy to reopen if it's useful to you.