[johnnyhuy]

Adds the OpenCode discovery plugin and teaches discoverInstalled to read its cache before probing.

Refs #17 (app side only - CLI parity stays a separate PR, the release flows are independent, so the issue stays open)

What changed

• New plugin at src/opencode-plugin/hoist-discover.ts (no runtime deps, under 60 lines). At OpenCode startup it runs which for each catalog binary (claude, opencode, codex), reads --version, and atomically writes ~/.cache/hoist/discovery.json. Install path documented in src/opencode-plugin/README.md.
• discoverInstalled in src/main/installer/index.ts reads the cache first when the file is fresher than five minutes (DISCOVERY_CACHE_TTL_MS). Stale, malformed or missing cache, and cached paths that no longer exist, all fall back to the existing which + npm-global probe with no behaviour change. Renderer needs no change.

Verification

• mise run ci:app - passed (typecheck, lint, unit tests, build)
• New test scripts/test-discovery-cache.mjs (wired into test:unit) covers fresh/stale TTL boundary, malformed payloads, missing path and non-string version cases - all discovery cache cases passed
• Plugin run against a mocked layout (stub binaries, temp HOME):
  returned: {"claude-code":{"path":"/tmp/hoist-proof/homebrew/bin/claude","version":"2.1.204 (Claude Code)"},"codex":{"path":"/tmp/hoist-proof/npm-global/bin/codex","version":"codex-cli 0.46.0"}}
  Homebrew-path and npm-global installs both found, absent opencode correctly omitted.
• discoverInstalled against that cache returned the Homebrew path and version without probing.

Reviewer notes

• Nothing here needs a live provider key. Verifying inside a real OpenCode install needs OpenCode with the plugin registered (see README) - worth a manual check, the mocked run above covers the file contract.
• CLI parity (cli/src/lib/harnesses.ts reading the same cache) is deliberately left for a separate CLI PR.

[johnnyhuy]

Rebased onto current main (3a461a7) after #48, #50 and #52 landed behind this branch. Head is now 5777e85. The only conflict was the test:unit line in package.json - resolved by keeping both sides, so the suite now runs the cloud probe tests and the discovery cache test.

Local verification on the rebased head, from the worktree sandbox:

• npm run catalog:check - in sync
• npm run typecheck - clean
• npm run lint - clean
• npm run build (main, preload, renderer) - passed
• Unit tests passed individually: test-extract-base-url, test-doctor, test-versions, test-secrets, test-homebrew, test-codex-auth, test-probe-context, test-discovery-cache (all discovery cache cases passed)
• test-install-methods and test-probes-cloud could not finish in this sandbox - both stop at listen EPERM on 127.0.0.1, which the sandbox blocks. Neither file is touched by this PR, and the GitHub CI app job runs the full suite without that limit, so its result is the evidence for those two files.

Nothing user-facing changed in the rebase itself. The slice remains app-side only, refs #17, CLI parity stays a separate PR.