fix(opencode): resolve all unit test failures and add test-opencode-unit recipe

Bump submodule to include fixes for 19 CI test failures (PAM auth,
rate-limit trustProxy, config variant, permission defaults, managed
config loading, Bedrock timeout).

Add test-opencode-unit justfile recipe that runs the full upstream
turbo test suite, and wire it into test-all-fast/test-all-slow.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: pRizz

justfile

@@ -152,6 +152,10 @@ e2e: opencode-install-if-needed
 test-opencode-ui: opencode-install-if-needed
     bun run --cwd packages/opencode/packages/app test:unit
 
+# Run opencode upstream unit tests (turbo: opencode + fork-tests + app)
+test-opencode-unit: opencode-install-if-needed
+    OPENCODE_CONFIG_CONTENT='{"auth":{"enabled":false}}' bun turbo test --cwd packages/opencode
+
 # Optional submodule drift and dirty state check
 check-opencode-submodule-drift:
     git submodule status --recursive
@@ -211,10 +215,10 @@ check-docker:
     @echo "✓ Dockerfile check passed"
 
 # Run all tests (fast)
-test-all-fast: test-rust-fast test-node test-opencode-fork-tests test-opencode-broker
+test-all-fast: test-rust-fast test-node test-opencode-fork-tests test-opencode-broker test-opencode-unit
 
 # Run all tests (slow, includes doc-tests)
-test-all-slow: test-rust test-node test-opencode-fork-tests test-opencode-broker
+test-all-slow: test-rust test-node test-opencode-fork-tests test-opencode-broker test-opencode-unit
 
 # Run all tests (fast)
 test: test-all-fast

packages/core/src/docker/Dockerfile

@@ -525,7 +525,7 @@ COPY --chown=opencoder:opencoder packages/opencode /tmp/opencode-local
 # Update it by running: ./scripts/update-opencode-commit.sh
 RUN set -eux; \
     OPENCODE_COMMIT_OVERRIDE="${OPENCODE_COMMIT:-}"; \
-    OPENCODE_COMMIT="8288776c52bf07f1ac703a62a6b0ec3dcb0ae2c2"; \
+    OPENCODE_COMMIT="4e17ce08f5002f376e3d5db033f18c853c69a4f7"; \
     if [ -n "${OPENCODE_COMMIT_OVERRIDE}" ]; then OPENCODE_COMMIT="${OPENCODE_COMMIT_OVERRIDE}"; fi; \
     rm -rf /tmp/opencode-repo; \
     if [ "${OPENCODE_SOURCE}" = "local" ]; then \