feat(agents): add centralized GPT apply_patch permission guard

Extract hardcoded GPT apply_patch permission logic into a reusable module
to ensure consistent behavior across all agents. This prevents GPT models
from using the unreliable apply_patch tool while allowing other models.

- Add gpt-apply-patch-guard.ts with GPT_APPLY_PATCH_GUIDANCE and getGptApplyPatchPermission
- Update Hephaestus agent to use centralized permission logic
- Update Sisyphus-Junior agent to use centralized permission logic
- Update all GPT prompt builders to reference shared guidance constant

🤖 Generated with assistance of OhMyOpenCode

src/cli/doctor/checks/model-resolution-cache.ts

@@ -1,16 +1,10 @@
 import { existsSync, readFileSync } from "node:fs"
 import { homedir } from "node:os"
 import { join } from "node:path"
-import { parseJsonc } from "../../../shared"
+import { getOpenCodeCacheDir, parseJsonc } from "../../../shared"
 import type { AvailableModelsInfo } from "./model-resolution-types"
 
-function getOpenCodeCacheDir(): string {
-  const xdgCache = process.env.XDG_CACHE_HOME
-  if (xdgCache) return join(xdgCache, "opencode")
-  return join(homedir(), ".cache", "opencode")
-}
-
-function getOpenCodeConfigDir(): string {
+function getUserConfigDir(): string {
   const xdgConfig = process.env.XDG_CONFIG_HOME
   if (xdgConfig) return join(xdgConfig, "opencode")
   return join(homedir(), ".config", "opencode")
@@ -24,7 +18,7 @@ function getOpenCodeConfigDir(): string {
  * warnings in doctor.
  */
 function loadCustomProviderNames(): string[] {
-  const configDir = getOpenCodeConfigDir()
+  const configDir = getUserConfigDir()
   const candidatePaths = [
     join(configDir, "opencode.json"),
     join(configDir, "opencode.jsonc"),