fix(opencode): resolve /usr/local/bin -> /usr/bin opencode path in pod

The npm prefix in the Dockerfile is /usr, so opencode installs to
/usr/bin/opencode (symlink to /usr/lib/node_modules/...), not
/usr/local/bin/opencode. The cluster E2E failed with ENOENT on
/usr/local/bin/opencode. Fix in three places:
- Dockerfile ENV PRAGENT_OPENCODE_BIN=/usr/bin/opencode
- ~/k8s/pragent-webhook.yaml env value
- _opencode_bin() now defensive: if the configured path is missing,
  falls back to shutil.which('opencode') before the linuxbrew last-resort.
- Dockerfile + README deploy notes: containerd import is sudoless via
  the group-readable raw socket (the microk8s ctr wrapper sudo-wraps).

Verified: rebuilt + reimported + rolled out; PR #5 (sha 985061c0) review
posted in-pod via the opencode engine (findings=2 inline=2 ok=True),
summary + 2 [CRITICAL] inline comments with suggestions + refs + sha marker.

Co-Authored-By: Claude <noreply@anthropic.com>

pilot/README-webhook.md

@@ -230,8 +230,12 @@ Build + deploy after editing the pilot scripts or the factory:
 K="microk8s kubectl"; cd ~/Projects/pragent
 # 1. build the image (docker is in the microk8s group, no sudo)
 docker build -t pragent-webhook:opencode -f pilot/Dockerfile .
-# 2. import into microk8s containerd (needs sudo — one command)
-docker save pragent-webhook:opencode | sudo microk8s ctr images import -
+# 2. import into microk8s containerd — sudoless. the `microk8s ctr` wrapper
+#    sudo-wraps even in the microk8s group, so use the raw binary against the
+#    group-readable containerd socket directly:
+docker save pragent-webhook:opencode | \
+  /snap/microk8s/current/bin/ctr --address /var/snap/microk8s/common/run/containerd.sock \
+    --namespace k8s.io image import -
 # 3. apply + roll
 $K apply -f ~/k8s/pragent-webhook.yaml
 $K -n pragent rollout restart deploy/pragent-webhook