feat(opencode): cut plugin system and remote behavior feeds; add SessionContext assembly and Runner

- delete plugin machinery (loader, install, meta, hooks) and all trigger sites
- fold first-party provider auth into static registry (provider/hooks.ts)
- remove remote instruction URL fetch, skills remote puller, TUI plugin host
- add session/context.ts: single provenance-tagged context assembly point
- add session/runner.ts: admit/context/stream/tools loop with compaction policy
- relocate audit artifacts to audit/ (FORK-AUDIT, instruction docs as evidence)

packages/opencode/src/server/routes/instance/httpapi/server.ts

@@ -20,7 +20,6 @@ import { LSP } from "@/lsp/lsp"
 import { MCP } from "@/mcp"
 import { McpAuth } from "@/mcp/auth"
 import { Permission } from "@/permission"
-import { Plugin } from "@/plugin"
 import { PluginPtyEnvironment } from "@/plugin/pty-environment"
 import { InstanceStore } from "@/project/instance-store"
 import { Project } from "@/project/project"
@@ -42,7 +41,6 @@ import { Todo } from "@/session/todo"
 import { SessionShare } from "@/share/session"
 import { ShareNext } from "@/share/share-next"
 import { Skill } from "@/skill"
-import { Discovery } from "@/skill/discovery"
 import { Snapshot } from "@/snapshot"
 import { Storage } from "@/storage/storage"
 import { ToolRegistry } from "@/tool/registry"
@@ -219,13 +217,11 @@ const app = LayerNode.group([
   Ripgrep.node,
   Storage.node,
   Snapshot.node,
-  Plugin.node,
   ModelsDev.node,
   Provider.node,
   ProviderAuth.node,
   Agent.node,
   Skill.node,
-  Discovery.node,
   Question.node,
   Permission.node,
   PermissionSaved.node,