fix: complete OpenCode and Antigravity provider integration

[eliautobot]

Summary

Builds on #8 and completes the OpenCode + Antigravity provider integration as a follow-up/child branch.

• keeps both providers disabled by default and opt-in through VO_OPENCODE_ENABLED=1 / VO_ANTIGRAVITY_ENABLED=1
• resolves bare CLI names through PATH while still supporting explicit binary paths
• adds a narrow provider subprocess environment helper so new provider CLIs do not inherit Virtual Office/OpenClaw/runtime secrets by default
• wires OpenCode and Antigravity through chat, history, interrupt, roster, agent platform, chat bubbles, model/session metadata, and session APIs
• implements OpenCode agent create/delete/session behavior and keeps Antigravity as one-shot with local VO history only
• hardens OpenCode delete paths so registered custom dirs must match VO OpenCode metadata and symlink dirs are refused
• adds fake-CLI tests for command construction, env sanitization, path hardening, and provider session behavior

Security audit

I reviewed PR #8 and this follow-up for malware, malicious/hidden code, credential theft, and stealthy exfiltration patterns.

Findings:

• No added binary payloads, compressed payloads, generated executable blobs, install hooks, cron/systemd persistence, curl/wget downloaders, or shell command wrappers were found in the staged PR changes.
• No added API keys, PATs, gateway tokens, HMAC secrets, Twilio/Lemon credentials, _VO_INT, or VO_DEV references were found in the staged PR diff.
• New CLI subprocess calls use argv lists, not shell=True, and the provider code does not use eval/exec.
• The main security risk is inherent to local AI coding CLIs: if enabled, opencode/agy can read workspace files and talk to their upstream services. This PR mitigates that by making both providers disabled by default, requiring explicit operator opt-in, using provider-specific workspaces, and passing a narrow subprocess environment with explicit allowlists for any extra env vars.
• Antigravity remains intentionally stateless/one-shot; this PR does not claim unsupported native session list/delete behavior.

Verification

• python3 -m py_compile app/providers/process_env.py app/providers/opencode.py app/providers/antigravity.py app/discovery.py app/server.py tests/test_opencode_antigravity_providers.py tests/test_chat_sessions.py
• python3 tests/test_opencode_antigravity_providers.py — 29 checks
• python3 tests/test_chat_sessions.py — 28 checks
• python3 tests/test_hermes_desktop_discovery.py
• python3 tests/test_openclaw_managed_auth.py
• python3 tests/test_hermes_platform_bridge.py
• python3 tests/test_hermes_platform_plugin.py
• python3 tests/test_review_parser.py
• git diff --cached --check
• staged security scans for common secret, bypass, HMAC, shell/eval/exec, downloader, and suspicious token patterns

Did not run tests/test_workflow_e2e.py because it targets a live Product server on port 8090 by default.