Add separate OpenCode + Nemotron Workbench MCP app

[samhornstein]

Adds src/opencode-nemotron-mcp: a separate code-server app with the OpenCode agent, local NVIDIA Nemotron models, Workbench MCP tools, and generated workspace context. Defaults to a smaller model for T4 GPUs, with a larger model available for A100/H100 GPUs. Model inference stays on the VM; MCP tools use the authenticated user's Workbench and cloud APIs.

Built on #473. Until that PR lands, the diff against master also includes its original src/opencode-nemotron template. Those files match 3a31f42 exactly. This app has its own directory, template ID, and display name.

This PR:

• Serves code-server on 8443 and Ollama on 11434 (container-local). Pins OpenCode 1.18.22 and disables hosted session sharing.
• Defaults to nemotron-3-nano:4b — 2.8 GB of weights, targeting T4 16 GB or V100 16 GB.
• Offers nemotron-3.5-lightning:30b as the second model — 25 GB of weights, targeting A100 40 GB, A100 80 GB, or either Workbench H100 80 GB option. Keeps the menu to these two choices; custom tags remain available through the CLI.
• Reuses the wb-mcp-server and llm-context features. Runs services and context generation as abc, the authenticated Workbench user. OpenCode explicitly loads /config/.claude/CLAUDE.md, including from nested project directories, with instructions mapping the shared guides' tool names to OpenCode's wb_ names.
• Adds opencode-model: an interactive menu or opencode-model <tag>. Downloads only the selected model, checks tool support, and loads it before saving /config/.opencode-model and updating the agent config. Download or loading failures preserve the previous saved selection. Restarts reuse cached weights.
• Sets OLLAMA_CONTEXT_LENGTH=65536 and advertises the same context limit to OpenCode. Limits Ollama to one concurrent request and one loaded model to bound GPU memory use.
• Adds a dedicated CI workflow and regression tests for the new template.

Two implementation choices:

• Optional model selection happens on the first interactive OpenCode launch. Set OLLAMA_MODEL=prompt to start services without downloading a model. The wrapper then opens the picker when a user launches OpenCode in a terminal. Devcontainer lifecycle hooks have no interactive terminal, so they never wait for input. Automation can select a tag explicitly. The persistent override takes precedence over OLLAMA_MODEL; the tag remains a compose setting because Workbench's VM parser substitutes only a fixed set of template options.
• OpenCode uses the MCP server's native stdio transport. It launches and manages /opt/wb-mcp-server/wb-mcp-server as the agent user, using the existing wb credentials. The shared feature's HTTP daemon remains available for the other included clients. No changes to the shared MCP or context features are required.

Testing

• 15 regression tests passed, including interactive selection and cancellation, the two-entry menu, custom tags, model override precedence, cached restarts, deferred startup, context configuration, and download/tool-support/loading failures. Ollama responses are mocked; these tests do not download weights or require a GPU.
• Built the real shared Go MCP server and verified its stdio handshake, tool discovery, and wb_status dispatch with a fake wb CLI. This is included in the 15 tests.
• Bash syntax checks, JSON parsing, Docker Compose validation, and the new template ID uniqueness check passed.
• Confirmed git diff 3a31f42 -- src/opencode-nemotron is empty.
• The dedicated script tests and ShellCheck job and the repository shell lint job passed for 68ae8d5.

Not tested: a full Workbench container deployment, authenticated MCP calls against a real workspace, or model performance and GPU memory use at 64K context. GPU recommendations are memory estimates. P4 8 GB is documented as experimental for Nano 4B and needs separate validation, including the Ollama driver requirement.

Not registered in the test-pr.yaml container-build matrix: devcontainer up would download and load a model on a runner without a GPU. The dedicated workflow covers the scripts and MCP transport.

BENCH-9850