feat(acq-kits): openchamber wrapper owns a shared opencode server - #234

Redesign the openchamber kit so the browser UI and an optional terminal
TUI share one live OpenCode session by default, and simplify what the
kit's startup manages.

- Ship an `opencode` wrapper at ~/.local/bin/opencode (first on the
  base-image PATH, so it shadows the real binary and is what the sandbox
  entrypoint runs). With no args it idempotently starts a shared
  `opencode serve` on 0.0.0.0:4096, prints host-connect instructions, and
  offers to attach a TUI; with args it passes through to the real opencode.
- Reduce the startup script to managing OpenChamber only (install on first
  boot + respawn supervisor in skip-start mode); it no longer starts or
  supervises `opencode serve` — the wrapper owns that, on demand.
- Publish both container ports 3000 (OpenChamber) and 4096 (shared server);
  run the shared server unsecured (the sandbox is the security boundary).
- Rework scripts/verify: three-state offline gate (SKIP when python deps
  missing, real error on failure), a preferred RUN_ACQ live path (creates
  via acq, publishes 3000/4096, exercises the wrapper + on-demand server),
  and a gated RUN_SBX path that requires a pre-translated sbx-v2 kit.
- Drop the "*.npmjs.org" allow host: registry.npmjs.org serves metadata and
  tarballs, and a leading-* host breaks acq's (unquoted) neutral->sbx
  translation. Documented in-spec.
- Add docs/decisions/wrapper-entrypoint-owns-server.md and annotate the
  superseded premise of openchamber-mixin-not-sandbox-kit.md. Update README,
  TROUBLESHOOTING, and kits.yaml.

Ports need a manual `acq ports --publish` under acq until the upstream
publishedPorts translation (quickstart#221) reaches the pinned kit ref;
tracked as #233.

Co-authored-by: OpenCode Agent <[email protected]>

…rver)

The openchamber `opencode` wrapper is the sandbox entrypoint (it shadows
the real binary via PATH). Its no-arg path backgrounded `opencode serve`
with `nohup … &` and then returned (`exit 0`), so PID 1 exited and the
sandbox transitioned running -> stopped moments after `acq run` — visible
as a sandbox that "stops on its own" when you decline the TUI prompt or run
non-interactively. Introduced in this branch's wrapper redesign.

A Docker sandbox is "running" only while its entrypoint / PID 1 is alive.
Fix the wrapper's no-TUI path to hold a foreground process as PID 1:
- if it started the server here, `wait` on that background job;
- if a server already owns :4096, park on a liveness loop and only `exec`
  a fresh foreground server if the existing one disappears (avoids a
  double-bind that, under `set -e`, would itself kill the entrypoint).
The interactive "yes -> opencode attach" path already `exec`ed, so it was
unaffected.

- files/.local/bin/opencode: foreground handoff + "must stay PID 1" note.
- spec.yaml, README, docs/decisions/wrapper-entrypoint-owns-server.md:
  describe the foreground handoff and record the regression it prevents.
- TROUBLESHOOTING.md: add "sandbox stops on its own right after acq run";
  update the `acq exec … opencode` recipes to start the server detached
  (the wrapper now foregrounds).
- scripts/verify: add step 9 entrypoint-liveness regression guard (assert
  the no-arg wrapper blocks rather than returning); start the wrapper
  detached in step 5 so the live check doesn't hang.

Verified: host-side `RUN_ACQ=1 scripts/verify` passes all checks
(including the new liveness guard) on a sandbox-capable host.

Co-authored-by: OpenCode Agent <[email protected]>

markdownlint MD028/no-blanks-blockquote: a bare blank line separated two
adjacent blockquotes in the openchamber README. Join them with a `>`-only
line so they read as one blockquote and the Markdown Lint CI check passes.

Co-authored-by: OpenCode Agent <[email protected]>

Markdown Lint CI gates on npm audit --audit-level=moderate; this branch
predated the fix and was red on js-yaml GHSA-52cp-r559-cp3m + linkify-it
GHSA-v245-v573-v5vm. Bump the linter overrides (js-yaml 4.2.0->4.3.0,
+linkify-it 5.0.2) and regenerate the lockfile. 0 vulnerabilities at moderate.

Co-authored-by: OpenCode Agent <[email protected]>

…t step (#233 Increment A)

quickstart#221 is merged: acq's neutral→sbx translator now carries
backend_extras.sbx.publishedPorts, so applying the openchamber kit publishes
container ports 3000/4096 to the host at create time with no manual
`acq ports --publish`. Adopt that here (Increment A of #233):

- scripts/verify step 2b: instead of always publishing manually, VERIFY the
  ports were auto-published at create; only fall back to an explicit publish
  on an older acq that predates #221 (emitted as a non-fatal WARN, not a FAIL).
  Add a warn() helper for that non-fatal path.
- kits.yaml + README: replace the "translator does not yet carry publishedPorts;
  publish manually" wording with "carried at create (quickstart#221); older acq
  falls back" and reframe the remaining gap as msb port/background plumbing.

Increment B (msb/ppp parity) stays blocked and #233 stays open: acq still has
no neutral port-publish/background vocabulary and the msb adapter consumes
neither backend_extras.msb ports nor a background flag. No behavior change to
the wrapper or startup script.

Co-authored-by: OpenCode Agent <[email protected]>