fix: use workflow token for OpenCode GitHub access

[PANDAJSR]

Summary

• use the workflow GITHUB_TOKEN directly instead of the OpenCode App/OIDC token
• bypass the OpenCode bot collaborator check that reports opencode-agent[bot] as having no permissions
• ignore bot-authored comments and require /oc or /opencode at the start of a comment, preventing OpenCode's own session link from recursively triggering another workflow
• keep contents, issues, and pull requests write permissions on the job

Root causes fixed

1. Issue 中转管理后台，没法看到用户的SECTL用户名 #10 failed before starting the agent because OpenCode 1.18.25 checked opencode-agent[bot] through the collaborator API, which returned none.
2. Issue 对于没有图片输入能力的模型，希望可以接入有图片输入能力的模型作为工具，主agent可以调用这个工具 #6 first succeeded and created PR 识图模型工具已实现，测试全部通过 #14. Its own result comment included https://opencode.ai/...; the old contains(..., '/opencode') condition mistook that URL for a command, triggering a second run as opencode-agent[bot], which then produced the misleading permission error.

The documented use_github_token: true path avoids the App bot permission check. The stricter trigger condition prevents bot recursion.

Validation

• workflow YAML parsed successfully
• git diff --check passed

Related runs:

• https://github.com/SECTL/SecAgent/actions/runs/33508274317 (successful run that created PR 识图模型工具已实现，测试全部通过 #14)
• https://github.com/SECTL/SecAgent/actions/runs/33509326331 (recursive bot-triggered failure)
• https://github.com/SECTL/SecAgent/actions/runs/33510116030 (App bot permission failure)