Linked issue

None.

Type of change

• Bug fix
• New feature (with prior issue + design alignment)
• Refactor / code improvement
• Docs

What does this PR do

OpenCode permission prompts in Paseo now surface the provider's richer choices instead of collapsing everything to a generic accept action.

Users can choose Deny, Allow once, or Allow always. Allow always maps back to OpenCode's persistent permission reply, while older clients or fallback allow responses still approve only once. Full Access mode keeps its existing session auto-approval behavior.

How did you verify it

• npx vitest run packages/server/src/server/agent/providers/opencode/event-translator.test.ts --bail=1
• npx vitest run packages/server/src/server/agent/providers/opencode-agent.permission-actions.test.ts --bail=1
• npx vitest run packages/server/src/server/agent/providers/opencode-agent.full-access.test.ts --bail=1
• npm run typecheck
• npm run lint
• git diff --check

Risk surface

This changes only the OpenCode provider's normalized permission payload and response mapping. The app already renders provider-supplied permission actions generically; the main compatibility surface is old clients sending allow without selectedActionId, which remains mapped to one-time approval.

Checklist

• One focused change. Unrelated cleanups split out.
• npm run typecheck passes
• npm run lint passes
• npm run format ran (Biome)
• UI changes include screenshots or video for every affected platform
• Tests added or updated where it made sense

UI screenshot/video is not included because this PR changes provider action data and uses the existing permission action renderer without changing app UI code.