fix(server): load configured instruction files from the first turn on v2 - #6442

OpenCode 2.0.26 accepts the `instructions` array in opencode.json but never
reads it; only AGENTS.md files are discovered. A rules file listed there
reached the model only by accident, when the agent happened to read a file
next to an AGENTS.md, and any other file name never loaded at all.
OpenCode 2.0.30 loads the array itself (anomalyco/opencode#55539).

Until the engine pin moves, the server reads the workspace config's
`instructions` entries before each turn and writes the matching files as a
second session instruction entry next to OpenWork's own, so they are present
from the first turn and updated when they change.

- Only files inside the workspace are loaded (symlinks resolved); URLs,
  `~/` and absolute paths outside it are left for the engine.
- Under Bun the match uses Bun.Glob with dot files, since Bun's node:fs glob
  never matches paths such as `.opencode/AGENTS.md`.
- Clients cannot write the entry, as with `openwork.context`; it is capped below
  the engine's entry size limit, and its sync never blocks a turn.
- Once the pin is no longer 2.0.26 the server only deletes the entry.

Signed-off-by: Jalil <[email protected]>

…nfig

A workspace's opencode.json can come from someone else, such as a cloned
repository. Listing a local secret like `.env` under `instructions` would
have sent its contents to the model without the reader ever opening it.

Configured instructions now load only files that are part of the workspace
and are instruction documents:

- Markdown or text files (`.md`, `.mdc`, `.markdown`, `.txt`), judged by both
  a link's name and its target.
- Never a file the engine asks about before any agent reads it (`*.env`,
  `*.env.*`, `.env.example` aside).
- Never a file git ignores, checked with one `git check-ignore --stdin` call.
  Outside a repository there are no ignore rules; if git cannot read a
  checkout, nothing is synced.

Signed-off-by: Jalil <[email protected]>