feat: allow the Cursor agent to use opencode plugins

[justin-carper]

What

Lets the Cursor agent use installed opencode plugins, in two parts:

1. Plugin-bundled skills are mirrored into .cursor/skills/ alongside
   the existing skill sources.
2. Other plugins' custom tools (e.g. opencode-pty's pty_spawn,
   context-mode's ctx_*) are bridged to the Cursor agent as an
   opencode-plugin-tools MCP server.

Skills

• New lowest-priority scan roots in discoverSkills: the opencode plugin
  cache (~/.cache/opencode/packages/, %LocalAppData%\opencode\cache\packages
  on Windows) and skills//skill/ dirs alongside file-based plugins.
  Handles npm specs (pkg@latest, @scope/pkg@latest) and git specs
  (pkg@git+https:...). Project/global/skills.paths skills always win on
  duplicate ids.
• The per-turn re-sync also merges opencode's live app.skills inventory at
  the same lowest priority, so skills sourced from places this plugin doesn't
  scan still reach Cursor.
• No new config surface: folds into forwardSkills; the existing
  skills.include/exclude and permission filtering apply unchanged.

Plugin tools

• The bridge re-imports each plugin module from the package cache and reads
  its tool map — mirroring the exact closures opencode executes (no
  session-loopback prompt, no LLM turn cost per call).
• Mirrored tools run inside a loopback-only control server (random port +
  per-session bearer token). A dependency-free stdio JSON-RPC MCP server
  (dist/sidecar/plugin-tools-mcp.js) proxies tools/list / tools/call
  and is merged into the forwarded mcpServers at startup and re-checked
  each turn.
• Permission gate mirrors opencode semantics: wildcard permission keys,
  evaluation of every pattern a tool's ask requests, last matching rule
  wins, ~/$HOME pattern expansion. ask/unconfigured fails closed with
  a clear message (the interactive prompt can't surface to the Cursor agent).
• Config: forwardPluginTools: false disables; pluginTools.include/exclude
  filter tool ids (wildcards supported).

{ "permission": { "pty_spawn": "allow", "ctx_*": "allow" } }

Pattern-scoped rules work too (specific patterns after the wildcard they
narrow):

{ "permission": { "pty_spawn": { "*": "ask", "/tmp/*": "allow" } } }

Verification

• npx tsc --noEmit clean; npm run build clean
• npx vitest run → 41 files, 607/607 tests (new: skill-discovery plugin
  cases, plugin-tools bridge suite, full-plugin wiring suite)
• E2E smoke against the built plugin: bridge lands in
  mcpServers["opencode-plugin-tools"]; a tool whose execute calls
  ctx.ask is rejected when unconfigured and runs when allowed — verified
  over a real MCP child process
• Bun smoke (opencode's runtime): 16 real tools mirrored from
  opencode-pty + context-mode, 0 failures

Docs

• README: plugin-bundled skills documented under Skills; new "Plugin tools"
  section with permissions, filtering, and limitations
• docs/superpowers/plans/2026-09-01-plugin-bundled-skills-mirror.md — plan
• docs/superpowers/plans/2026-09-01-plugin-tools-findings.md — feasibility
  findings + recorded follow-ups (memoize per-turn plugin init, shared
  cache-root helper for version-check, symlink containment, token handoff)