fix(opencode): resolve /usr/local/bin -> /usr/bin opencode path in pod

The npm prefix in the Dockerfile is /usr, so opencode installs to
/usr/bin/opencode (symlink to /usr/lib/node_modules/...), not
/usr/local/bin/opencode. The cluster E2E failed with ENOENT on
/usr/local/bin/opencode. Fix in three places:
- Dockerfile ENV PRAGENT_OPENCODE_BIN=/usr/bin/opencode
- ~/k8s/pragent-webhook.yaml env value
- _opencode_bin() now defensive: if the configured path is missing,
  falls back to shutil.which('opencode') before the linuxbrew last-resort.
- Dockerfile + README deploy notes: containerd import is sudoless via
  the group-readable raw socket (the microk8s ctr wrapper sudo-wraps).

Verified: rebuilt + reimported + rolled out; PR #5 (sha 985061c0) review
posted in-pod via the opencode engine (findings=2 inline=2 ok=True),
summary + 2 [CRITICAL] inline comments with suggestions + refs + sha marker.

Co-Authored-By: Claude <noreply@anthropic.com>

pilot/opencode_review.py

@@ -56,11 +56,12 @@ def _factory_dir() -> str:
 
 def _opencode_bin() -> str:
     b = os.environ.get("PRAGENT_OPENCODE_BIN")
-    if b:
+    if b and os.path.isfile(b):
         return b
     found = shutil.which("opencode")
     if found:
         return found
+    # last resort: the known linuxbrew path on the dev host.
     return "/home/linuxbrew/.linuxbrew/bin/opencode"