release-smoke-test

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The OpenCode config loads a plugin at runtime via the file URL file://$SMOKE/app/node_modules/oh-my-opencode-slim/dist/index.js which will be executed and can directly control agent prompts/behavior, and the smoke procedure depends on that plugin being present.