fix: mount OpenCode password secret in guest

[ajaxbits]

Summary

• add the encrypted OpenCode service environment file on top of deployed Grace editor bootstrap fixes
• materialize the agenix secret as a real file so the read-only guest VirtioFS share can expose it
• use OpenCode beta's built-in opencode basic-auth username; the supplied custom username is not supported by this version

Validation

• complete patroclus configuration evaluation
• decrypted the encrypted file with the patroclus SSH identity without printing its value
• verified the configured guest service EnvironmentFile and read-only secret share

Supersedes #157, which was based on pre-#156 configuration and could not expose the agenix symlink target to the guest.