feat: scaffold OpenCode V2 toolkit with safe project installer

FIXME.md

@@ -0,0 +1,22 @@
+# Known issues and validation gaps
+
+- [ ] The installer deliberately refuses projects with both
+  `opencode.json` and `.opencode/opencode.json`. Decide whether safe support for
+  multi-layer config is worth implementing after studying V2 merge behavior.
+- [ ] The plugin passes V2 contract tests and the package tarball installs, but
+  `opencode api --standalone get /api/plugin` returned an empty plugin list for
+  both the installed package and a minimal local smoke plugin. Diagnose whether
+  this reflects loading, API reporting, or configuration before claiming the
+  custom tool is active.
+- [ ] `opencode debug agents` discovers the three installed toolkit agents from
+  the tarball, but this does not establish that plugin hooks/tools load.
+- [ ] Provider-backed workflows (agent delegation and actual skill invocation)
+  have not been tested; they require configured credentials and explicit
+  approval of any model usage.
+- [ ] Global/XDG installation is not implemented; project-level update and
+  uninstall are supported, while global installation remains out of scope.
+- [ ] The package name and GitHub URL are provisional and must be confirmed
+  before publishing.
+- [ ] The uninstaller currently removes files incrementally. If an I/O failure
+  occurs mid-uninstall, inspect the install manifest and rerun after resolving
+  the filesystem issue.