feat: make AForge exec the default harness

[AbirAbbas]

Summary

• make AForge the default CloudSecurity-AF harness
• run AForge through exec by default
• bundle the released AForge CLI while retaining OpenCode
• expose configuration-only provider and command rollback controls

Dependency chain

Keep this PR in draft until:

• Agent-Field/aforge-v2#5 lands on chat-v2
• Agent-Field/aforge-v2#6 lands on the release line
• ghcr.io/agent-field/aforge-v2:chat-v2-exec is published and publicly pullable
• feat(harness): add AForge parity across Python, Go, and TypeScript agentfield#905 lands with the Python, Go, and TypeScript adapters defaulting AForge to exec

OpenCode remains installed and is an explicit configuration-only rollback.

Validation

• focused AForge default and OpenCode rollback tests passed
• Docker Compose configuration resolves with the AForge defaults
• the shared Python product image pattern was validated against the local AForge release image