fix(server): bound OpenCode V2 approval and question replies

[saphid]

OpenCode V2 approval and question replies now have a ten-second bound and pass the cancellation signal through to the SDK. A stalled reply can no longer hold the request indefinitely; normal replies preserve the existing behavior.

Current head 26d262df5 includes current V2 base 7dd9873ed and the shared test-only prerequisite #10865. Merge #10865 first; the topic itself changes 2 files. This rebuild removes the obsolete merged-base history from the PR diff.

Validation: 59 focused tests pass across the affected feature and foundation persistence coverage. Scoped server typecheck passes; targeted lint, formatting and diff checks pass. New-head CI is pending.

Independent cross-provider review was unavailable: the direct Claude Opus 5 high launcher in this audit exited 1 with expired OAuth before inference. No Claude review is claimed.

Targets Orchestrator V2 in #2829. Updated with GPT-6 in Codex/T3.

[macroscopeapp]

Approvability

Verdict: Approved at 26d262d

Macroscope's review found this PR approvable — This is a narrowly scoped server bug fix that bounds existing OpenCode approval and question replies, propagates cancellation, and verifies timeout plus retry behavior for both paths. The remaining test-only change has no production impact, and no product defaults or static-analysis settings are modified.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate 26d262d