feat: add openhands and opencode-web services

openhands runs each agent session in a container it spawns through the host
docker socket, so the socket is mounted read-write and host.docker.internal is
resolved. No host workspace is exposed.

opencode-web serves the opencode agent as a browser UI. The vendor image ships
only the opencode binary on bare Alpine, so a local Dockerfile adds bash, git,
curl and an ssh client.

opencode-web/Dockerfile

@@ -0,0 +1,10 @@
+FROM ghcr.io/anomalyco/opencode:latest
+
+# Shell, git, HTTP and SSH clients for the commands the agent runs.
+RUN apk add --no-cache \
+      bash \
+      curl \
+      git \
+      openssh-client
+
+WORKDIR /workspace