Release OpenCode Model Control 0.2.0

[BitL8-ByteShort]

Outcome

• Add attachment-aware media switching to the saved vision worker, plus automatic code-worker → read-only reviewer → at most one repair handoff.
• Add safe optional Omc-Router default ownership, managed-connection upgrades, and a manual runtime-access check kept separate from benchmark evidence.
• Replace the split dashboard with full-width stacked modules, a collapsible desktop sidebar, and a mobile drawer.
• Add per-process mutation authorization, stricter connector/plugin boundaries, Node 22.12+/24 CI, and complete release/security documentation.

Verification

• npm run verify: 213/213 tests, TypeScript check, and production build passed.
• npm audit --audit-level=high: 0 vulnerabilities.
• Exact final tarball clean-installed in a disposable prefix; version, Connect, status, Disconnect, and private file modes passed.
• Final tarball SHA-256: 59c6094a9b7dd57b897ee59c41269b154861de408db7c138c22725d17a1e67df.
• Browser acceptance passed at 1440px, 800px, and 390px with no horizontal overflow or console errors.
• Security review completed with no reportable findings after both validated candidates were fixed.
• Isolated OpenCode parser, MCP handshake, plugin, and connector acceptance passed. A current-tree live provider response remains unverified because the sandbox could not reach the provider endpoint; Linux fresh-install/provider acceptance remains separately documented.

Safety and compatibility

• Unknown pricing and unavailable models still fail closed in every cost mode.
• Paid routing remains an explicit user choice and cannot bypass capability gates.
• No credentials, private prompts, customer data, absolute user paths, or generated local settings are included.
• OpenCode config writes are explicit, receipt-owned, recoverable, and preserve unrelated settings.
• New behavior includes failure-path coverage where relevant.
• I signed off my commits according to the DCO in CONTRIBUTING.md.