Fix canonical OpenCode workspace permissions

[chubes4]

Summary

• resolve the canonical DMC workspace before fresh runtime config generation
• resolve it before upgrade-time opencode.json reconciliation
• replace stale managed absolute grants while preserving explicit overrides
• cover discovery, generated permissions, and stale-grant repair

Closes #352.

Verification

• ./tests/dm-workspace-discovery.sh
• ./tests/opencode-local-plugin-path.sh
• ./tests/repair-opencode-json.sh
• bash -n on changed shell scripts
• git diff --check
• all other shell tests pass except pre-existing environment-sensitive failures reproduced on main in tests/service-migration.sh, tests/source-mode.sh, and tests/verify.sh

AI assistance: OpenAI GPT-5.6 Sol via OpenCode diagnosed the lifecycle gap, implemented the fix, and ran verification; Chris Huber remains responsible for every line.