feat(tier2): add opencode.json.fragment with deny rules + path allowlist

conductor/tier2/opencode.json.fragment

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "default_agent": "tier2-autonomous",
+  "agent": {
+    "tier2-autonomous": {
+      "model": "minimax-coding-plan/MiniMax-M3",
+      "temperature": 0.4,
+      "permission": {
+        "edit": "allow",
+        "read": {
+          "*": "deny",
+          "C:\\projects\\manual_slop_tier2\\**": "allow",
+          "C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2\\**": "allow",
+          "C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2_failures\\**": "allow"
+        },
+        "write": {
+          "*": "deny",
+          "C:\\projects\\manual_slop_tier2\\**": "allow",
+          "C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2\\**": "allow",
+          "C:\\Users\\Ed\\AppData\\Local\\manual_slop\\tier2_failures\\**": "allow"
+        },
+        "bash": {
+          "*": "allow",
+          "git push*": "deny",
+          "git checkout*": "deny",
+          "git restore*": "deny",
+          "git reset*": "deny"
+        }
+      }
+    }
+  }
+}