Group the sources into aliased modules and lint with the published plugins (#23)

Groups the flat `src/` into cohesive modules and turns on the published lint plugins. No behavior change.

## Module layout

Each module is a direct `src/` subfolder with an `index.ts` barrel and a `#` alias in `package.json` `imports` (layer order, top first):

| Alias | Files |
| --- | --- |
| `#prepare` | `index.ts` (the prepare phase entry point) |
| `#run` | `index.ts` (the run phase entry point) |
| `#post` | `index.ts` (the post phase entry point), `post.ts`, `post.test.ts` |
| `#agents` | `auth.ts`, `opencode.ts` (Codex / Claude Code sign-in, OpenCode args and output) |
| `#processes` | `child.ts`, `isolation.ts` |
| `#runtime` | `runtime.ts`, `credentials.ts` |
| `#profiles` | `profiles.ts` |
| `#common` | `errors.ts`, `json.ts` |
| `#testing` | `index.ts` (unchanged) |

Every top-level entry of `src/` is an aliased module folder. Tests stay next to their code as `*.test.ts`. Each phase's `index.ts` is its entry point, and `action.yml` now runs `node src/<phase>/index.ts`. The post phase's logic moved to `src/post/post.ts` so its test can import it; `index.ts` keeps the env reading and the `import.meta.main` call. `run`'s prompt URL is now `../../prompt.md`. `scripts/protect-source.sh` now copies `src/` recursively (it used to copy `src/*.ts` only), and the workflow test checks that module files get staged too.

## Lint plugins

- New devDependencies: `eslint-plugin-explicit-types@^0.6.1` and `eslint-plugin-import-structure@^0.10.2`, both in `jsPlugins`. The lockfile comes from a real `npm install`.
- Enabled configs: `importStructure.configs.modules`, `explicitTypes.configs.concrete`, `explicitTypes.configs.absence`.
- **explicit-types `naming` is off** (the other app repos turn it on). Its `upper-snake-string-unions` and `no-upper-snake-object-keys` rules fire on wire tokens this repo doesn't choose: profile types `"claude" | "codex" | "opencode"` from `profiles.json`, failure reasons posted to Gitea, Gitea's `"new" | "old"` side, and environment variable names such as `PATH`. Satisfying them would change behavior or need opt-outs. This is logged as an open question for the user.

Lint fixes, all type-level:
- `Pick<BotProfile, "type" | "model">` became a named `ProfileIdentity` interface that `BotProfile`, `ProfileFailure`, and `RuntimeProfile` extend. `RuntimeOutcome` is now `RuntimeSuccess | RuntimeFailure`.
- Inline object types became named interfaces.
- `Record<string, string>` env maps became `NodeJS.ProcessEnv`. `JsonObject` and the verdict table became `NodeJS.Dict<…>`.
- `T | undefined` locals and returns became `T | null` with matching checks. `typeof fetch` became a `Fetcher` type.
- Claude's result fields are held in camelCase (`isError`, `apiErrorStatus`) after parsing, because `id-match` rejects snake_case interface members.
- Duplicate import sources are merged (`import-structure/no-duplicate-import-source`).

## Verification

- `vp check`: clean.
- `vp test`: 61 passed and 5 skipped as a normal user. All 66 passed as root in `node:24-bookworm`.
- Each phase (`node src/<phase>/index.ts`) run from a `protect-source.sh` copy loads its full alias graph under Node.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #23
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

src/agents/opencode.test.ts

@@ -0,0 +1,105 @@
+import { assert, expect, test } from "vite-plus/test";
+
+import { AgentAuthError } from "#profiles";
+
+import {
+  collectOpenCodeOutput,
+  openCodeArgs,
+  openCodeError,
+  parseOpenCodeEvents,
+} from "./opencode.ts";
+
+test("builds a non-interactive auto-approved OpenCode command", () => {
+  expect(openCodeArgs("openrouter/qwen/qwen3.8-27b", "Review this")).toStrictEqual([
+    "run",
+    "--format",
+    "json",
+    "--auto",
+    "--model",
+    "openrouter/qwen/qwen3.8-27b",
+    "Review this",
+  ]);
+});
+
+test("returns the final visible OpenCode text event", () => {
+  expect(
+    parseOpenCodeEvents(
+      [
+        JSON.stringify({ type: "step_start", part: { type: "step-start" } }),
+        JSON.stringify({ type: "text", part: { type: "text", text: "draft" } }),
+        JSON.stringify({ type: "text", part: { type: "text", text: "done" } }),
+        JSON.stringify({ type: "step_finish", part: { type: "step-finish" } }),
+      ].join("\n"),
+    ),
+  ).toBe("done");
+});
+
+test("rejects a successful OpenCode run without visible text", async () => {
+  await expect(async () => {
+    parseOpenCodeEvents('{"type":"step_start"}');
+    await Promise.resolve();
+  }).rejects.toThrow("no text output");
+});
+
+const encode = (value: string): Uint8Array => new TextEncoder().encode(value);
+
+test("streams OpenCode output while collecting it", async () => {
+  const stdout = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(encode("first\n"));
+      controller.enqueue(encode("second\n"));
+      controller.close();
+    },
+  });
+  const stderr = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(encode("warning\n"));
+      controller.close();
+    },
+  });
+  const shown: string[] = [];
+
+  const result = await collectOpenCodeOutput(
+    stdout,
+    stderr,
+    (chunk: Uint8Array) => {
+      shown.push(`out:${new TextDecoder().decode(chunk)}`);
+    },
+    (chunk: Uint8Array) => {
+      shown.push(`err:${new TextDecoder().decode(chunk)}`);
+    },
+  );
+
+  expect(result).toStrictEqual({ stdout: "first\nsecond\n", stderr: "warning\n" });
+  expect(shown).toStrictEqual(["out:first\n", "err:warning\n", "out:second\n"]);
+});
+
+const openRouterError = (statusCode: number, message: string): string =>
+  JSON.stringify({
+    type: "error",
+    sessionID: "ses_test",
+    error: {
+      name: "APIError",
+      data: {
+        message,
+        statusCode,
+        isRetryable: false,
+        responseBody: JSON.stringify({ error: { message, code: statusCode } }),
+      },
+    },
+  });
+
+test("reports a rejected OpenRouter key as a sign-in failure", () => {
+  const error = openCodeError(openRouterError(401, "User not found."));
+  assert.instanceOf(error, AgentAuthError);
+  expect(error.message).toBe("opencode sign-in failed");
+  assert.instanceOf(error.cause, Error);
+  expect(error.cause.message).toBe("opencode APIError (API error 401): User not found.");
+});
+
+test("surfaces an OpenCode error event instead of empty output", () => {
+  expect(() => parseOpenCodeEvents(openRouterError(429, "Rate limit exceeded"))).toThrow(
+    "API error 429",
+  );
+  expect(openCodeError('{"type":"text","part":{"text":"ok"}}')).toBeNull();
+});