feat: remove legacy OpenCode runtime

Cut product flows over to Coding/Pi and retain only the migration-owned v1 boundary. Promote supported native optional packages because electron-builder omitted pnpm transitive optional closure from the packaged ASAR.

electron/api/route-utils.ts

@@ -3,7 +3,7 @@ import { PORTS } from '../utils/config';
 
 /**
  * Allowed CORS origins — only the Electron renderer (Vite dev or production)
- * and the local opencode runtime are permitted to make cross-origin requests.
+ * and explicitly trusted local product surfaces may make cross-origin requests.
  */
 const ALLOWED_ORIGINS = new Set([
   `http://127.0.0.1:${PORTS.NIANCODE_DEV}`,
@@ -44,20 +44,11 @@ export function requireJsonContentType(req: IncomingMessage): boolean {
 export function setCorsHeaders(
   res: ServerResponse,
   origin?: string,
-  runtimeUrl?: string,
 ): void {
   // Only reflect the Origin header back if it is in the allow-list.
   // Omitting the header for unknown origins causes the browser to block
   // the response — this is the intended behavior for untrusted callers.
-  let runtimeOrigin: string | null = null;
-  if (runtimeUrl) {
-    try {
-      runtimeOrigin = new URL(runtimeUrl).origin;
-    } catch {
-      runtimeOrigin = null;
-    }
-  }
-  if (origin && (ALLOWED_ORIGINS.has(origin) || origin === runtimeOrigin)) {
+  if (origin && ALLOWED_ORIGINS.has(origin)) {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Vary', 'Origin');
   }