Add an experimental OpenCode v2 runtime for `/review-pr`

[dceoy]

Problem

opencode-action installs OpenCode through the v1 curl installer and invokes opencode github run. OpenCode v2 beta is distributed through the npm next channel, uses the opencode2 executable, and does not currently expose a compatible github run command.

The bundled /review-pr workflow does not require the full OpenCode GitHub event runner: it can execute the trusted review orchestrator and submit structured reviews through fixed helper scripts. This makes review-only mode the smallest viable scope for initial v2 support.

Goal

Add opt-in OpenCode v2 support for /review-pr while retaining OpenCode v1 as the default runtime.

Dependencies

• Extract GitHub App token exchange from opencode github run #57: action-owned GitHub App token exchange and cleanup.
• Validate review-only isolation against OpenCode v2 #58: verified fail-closed review-only isolation for OpenCode v2.

Proposed changes

• Add an explicit runtime input such as:

  runtime: v1 # v1 | v2-beta

  Do not infer the runtime generation solely from opencode-version, because v2 packages may still use 1.x package versions during development.

• Keep runtime: v1 as the default.

• Install v2 from a pinned or caller-selected @opencode-ai/cli@next version and invoke opencode2.

• Restrict runtime: v2-beta to detected /review-pr runs; fail clearly for general issue or PR-comment automation.

• Invoke the bundled review agent through the v2 noninteractive run command.

• Translate the separate model and variant inputs to the v2 provider/model#variant syntax without silently normalizing unsupported values.

• Preserve prompt expansion, explicit agent selection, timeout handling, failure annotations, and action outputs.

• Add a v1/v2 CI matrix with a credential-free CLI smoke test and mocked review helper coverage.

• Document the beta support level and compatibility policy.

Acceptance criteria

• runtime: v2-beta successfully starts opencode2 run for /review-pr.
• The existing default workflow remains on v1 with no caller changes.
• Non-review prompts fail before execution when v2-beta is selected.
• Model variants are passed using v2 syntax and invalid combinations remain actionable.
• App-authored structured reviews preserve the expected identity through Extract GitHub App token exchange from opencode github run #57.
• Hostile repository fixtures from Validate review-only isolation against OpenCode v2 #58 cannot affect the v2 review run.
• Tests cover installation, command construction, timeout, failure propagation, and runtime selection.