fix(opencode): route in-cluster clients directly to MCP backends

[xnoto]

Summary

Routes OpenCode directly to its in-cluster ToolHive MCP backend proxy Services and reserves vmcp-gateway for external consumers. Updates root and packaged routing instructions, chart documentation, and affected S3, SlideSpeak, and Twilio documentation skills.

Fixes #
N/A — owner-approved routing correction.

Type of change

• Bug fix
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending: repository hygiene, Helm validation, changed-chart detection, and opencode-server packaging. These validate chart content, not runtime MCP reachability.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — chart packages hand-authored files/ inputs through Helm; no generated source was edited.
• Pre-PR release review found no Critical/High findings after the direct-service preselection and aggregate-era rollback conditions were documented.

Impact and rollout

Producer: opencode-server chart 0.1.78; consumer: OpenCode sessions selected through the downstream kustomize-cluster Application pin.

Before the generated GitOps pin is selected, all 14 direct ToolHive proxy Services must be reconciled and healthy. After the pin merges and Argo CD reconciles, verify a fresh OpenCode session discovers the direct tool names and performs bounded read-only representative calls. The external vmcp-gateway aggregate remains unchanged.

After a confirmed merge, charts publishes the immutable OCI package and automation opens or updates the separate kustomize-cluster pin PR. That desired-state PR, its checks, reconciliation, health, and functional verification remain separate gates.

Rollback is a manual GitOps pin selection to an earlier immutable chart version; before selecting an aggregate-era version, verify vmcp-gateway and required members remain available.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking change: direct tool names lose the makeitwork_ prefix; affected packaged guidance is updated and post-rollout discovery is required.

AI-assisted change; reviewer scrutiny requested.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.