feat(kimi): give Kimi an agentic loop via OpenCode

[Oppen]

Closes #8.

Kimi reviewed via a single chat/completions call: no repo access, no ability
to build or run tests, and a diff truncated by head -n. This gives it an
agentic loop via OpenCode, matching the Claude and Codex reviewers.

What

• Replace the curl-based API call with opencode run --format json, backed by
  Moonshot (moonshotai/<model>, OpenAI-compatible provider).
• opencode is installed from a pinned release tarball verified by sha256 — no
  curl | bash of a mutable install script.
• The agent runs without the GitHub token (gets only MOONSHOT_API_KEY)
  and emits the review to stdout; a github-script step posts it. This matches
  how Claude and Codex post (agent emits, workflow posts).

Breaking

• Removes the max_diff_lines / max_tokens / temperature inputs — they were
  artifacts of the single-shot call and have no meaning for an agent.
• model is now used as moonshotai/<model> (default kimi-k2.5 unchanged).

Notes

• Untested end-to-end until it runs with a real KIMI_API_KEY.
• The OpenCode JSONL event schema ({"type":"text","part":{"text":...}}) was
  taken from the opencode run source, not docs — pinned version mitigates drift.