fix(tests): make opencode setup/apply tests hermetic under the container guard (#10057)

Same class as the setup-qwen drain in c2df757610: since #10057 the
config-write guard exits 2 on ephemeral container runtimes, so the four
runSetupOpenCodeCommand tests and the /api/cli-tools/apply JSONC test
were environment-sensitive (red on container devboxes, green on
ubuntu-latest CI). They exercise the plugin install/merge path, not the
guard — pass allowContainerWrite / set the env override so they run
deterministically everywhere. The guard keeps its own dedicated coverage.

Refs #9985

tests/unit/cli-setup-opencode.test.ts

@@ -74,6 +74,9 @@ describe("omniroute setup opencode", () => {
       // Commander turns `--base-url` into `baseUrl` — the runner must accept it.
       baseUrl: "http://10.0.0.5:20128",
       nonInteractive: true,
+      // These tests exercise the plugin install/merge path, not the container
+      // guard (#10057) — keep them hermetic on container devboxes/CI.
+      allowContainerWrite: true,
     });
     assert.equal(r.exitCode, 0);
 
@@ -99,6 +102,7 @@ describe("omniroute setup opencode", () => {
       configDir: CONFIG_DIR,
       baseUrl: "http://10.0.0.9:20128",
       nonInteractive: true,
+      allowContainerWrite: true,
     });
     assert.equal(r.exitCode, 0);
 
@@ -127,7 +131,11 @@ describe("omniroute setup opencode", () => {
       })
     );
 
-    const r = await runSetupOpenCodeCommand({ configDir: CONFIG_DIR, nonInteractive: true });
+    const r = await runSetupOpenCodeCommand({
+      configDir: CONFIG_DIR,
+      nonInteractive: true,
+      allowContainerWrite: true,
+    });
     assert.equal(r.exitCode, 0);
 
     const cfg = readConfig();
@@ -140,7 +148,11 @@ describe("omniroute setup opencode", () => {
   it("fails with a clear error (exit 1) when the bundled plugin dist is missing", async () => {
     fs.rmSync(path.join(FAKE_PLUGIN_DIR, "dist"), { recursive: true, force: true });
     try {
-      const r = await runSetupOpenCodeCommand({ configDir: CONFIG_DIR, nonInteractive: true });
+      const r = await runSetupOpenCodeCommand({
+        configDir: CONFIG_DIR,
+        nonInteractive: true,
+        allowContainerWrite: true,
+      });
       assert.equal(r.exitCode, 1);
     } finally {
       makeFakePluginDist();

tests/unit/cli-tools-apply-opencode-jsonc.test.ts

@@ -15,6 +15,10 @@ const originalFetch = globalThis.fetch;
 const originalJwtSecret = process.env.JWT_SECRET;
 const originalApiKeySecret = process.env.API_KEY_SECRET;
 const originalXdg = process.env.XDG_CONFIG_HOME;
+const originalAllowContainerWrite = process.env.OMNIROUTE_ALLOW_CONTAINER_CONFIG_WRITE;
+// This test exercises the apply/merge path, not the container guard (#10057) —
+// keep it hermetic on container devboxes/CI.
+process.env.OMNIROUTE_ALLOW_CONTAINER_CONFIG_WRITE = "1";
 const testRoots = new Set<string>();
 
 async function createAuthCookie(): Promise<string> {
@@ -72,6 +76,9 @@ test.afterEach(async () => {
   else process.env.API_KEY_SECRET = originalApiKeySecret;
   if (originalXdg === undefined) delete process.env.XDG_CONFIG_HOME;
   else process.env.XDG_CONFIG_HOME = originalXdg;
+  if (originalAllowContainerWrite === undefined)
+    delete process.env.OMNIROUTE_ALLOW_CONTAINER_CONFIG_WRITE;
+  else process.env.OMNIROUTE_ALLOW_CONTAINER_CONFIG_WRITE = originalAllowContainerWrite;
   for (const root of testRoots) await fs.rm(root, { recursive: true, force: true });
   testRoots.clear();
 });