test: keep CI tests off the npm registry and close code scanning alerts #718

Why

Unit Tests (linux) on main failed after #717 merged, blocking the 1.0.64 release. The same nine prompt.test.ts context-folding cases also timed out in earlier PR runs (#713 at 98091f30bf, #717 at 41c7f47) and passed in others on identical trees:

• All nine load a custom tool from .opencode/tools; the interleaved folding tests without custom tools passed in the same runs.
• Custom tools wait for the background @opencode-ai/plugin install of their .opencode directory. Under bun the bundled SDK next to the executable is absent, so each install runs arborist against the public npm registry. Probes in two CI runs measured about 1.8 s per test and 33 registry installs for test directories per run; the rest of the suite avoids this by mocking the wait or pre-seeding the SDK.

Code scanning also reports three open alerts, all in test code: an incomplete URL scheme check (js/incomplete-url-scheme-check), code built from a stringified value (js/bad-code-sanitization) and an error string returned by a fixture (js/stack-trace-exposure).

A diff-coverage pass over the 1.0.64 changes found untested guards: the per-session organizer ceiling and interrupt settlement in the opencode host, the ceiling and oversized-reasoning skip in the core runner, and the MCP path of hook-forced asks.

Scope

Test preload, the three alerting test files, and new regression tests in core and opencode. No runtime source changes.

Approach

• Point OPENCODE_PLUGIN_SDK_PATH at a local stub in the opencode test preload, as the preload already does for the global config directory. Tests that need the real SDK keep placing it in their own node_modules.
• Fix the alert sites: reject data: and vbscript: links in the sanitizer test, generate the override value inside the tool source, return a generic fixture error.
• Add regression tests for the uncovered guards and check each against a mutation of the guarded code.

Acceptance

• The nine folding tests make no registry install and pass in CI; a full local opencode run makes no registry install for test directories.
• The three code scanning alerts close after the default-branch scan.
• New tests fail when the guarded line is disabled: session ceiling (both hosts), interrupt abort (opencode host), forced-ask confirmation and effective input (MCP).
• Lint ratchet, typecheck, core and opencode suites, DAG gate.