fix(opencode): discover project directory permission configs - #4856

Summary

• rtk hook opencode now discovers project permissions in .opencode/opencode.json(c) directories, not only direct ancestor opencode.json(c) files, so a project-level deny or ask is seen by the before/after verdict comparison and the rewrite is skipped ({}).
• Source order follows OpenCode: direct files outermost first, then .opencode directories outermost first, opencode.json before opencode.jsonc in each directory. Global config and OPENCODE_CONFIG semantics are unchanged.
• Tests cover subdirectory discovery, deny and ask, a project-directory deny over a nearer direct allow, and jsonc priority.

Fixes #4855 (deny lifted when the project policy lives in .opencode/).

Test plan

• cargo fmt --all && cargo clippy --all-targets && cargo test — not run locally; this patch was prepared from source inspection in an environment that does not build the crate. Please rely on CI and tell me if anything fails, I will follow up.
• Manual testing: installed rtk 1.1.0 reproduces the defect ({"command":"rtk git diff"} under a .opencode/opencode.json deny, {} under ./opencode.json); the patch applies cleanly on develop (7e92da0) and git diff --check is clean.

_{@superbiche · user · drafted with Claude Fable 5.1, reviewed before posting; the voice and decisions are mine.}