fix(ci): isolate login test, install OpenCode CLI for GGA, scope -race to ubuntu

[danielxxomg]

Summary

Three independent P0 CI-hygiene fixes, each shippable on its own. Spec/design/tasks live under openspec/changes/fix-ci-hygiene/. Implementation follows design.md's corrected (overridable-package-var) approach rather than the proposal's rejected DI-field design.

Phase 1 — Test isolation + bounded device-login timeout (REQ-CI-008 / REQ-CI-009)

TestRunLogin_EmptyToken drove the full rootCmd.Execute() path against real github.com and waited for the server-declared 10-minute expires_in, so it made real HTTP/2 calls and could hang CI for ~10 minutes.

• Rewrote the test to redirect cloud.DeviceLoginBase to a local httptest pending server (expires_in=1, interval=1) and call runLoginWithDeps(&cobra.Command{}, nil, deps) with mock deps via setupTestDeps → resolves in ~1s, no real network, error mentions timed out/token.
• Added overridable var deviceLoginTimeout = 60 * time.Second in internal/cloud/oauth_device.go; RequestToken now wraps the flow in context.WithTimeout(...), checks ctx.Err() each iteration, and propagates ctx to the device-code/access-token requests via http.NewRequestWithContext. A stalled/hostile authorization endpoint can no longer hold the client for the full server expires_in.
• New TestRequestToken_DeviceLoginTimeout proves ctx cancellation (<1s, context.DeadlineExceeded).
• Extracted pollForAccessToken to satisfy golangci-lint funlen.

TDD (strict):

step	RED	GREEN
cmd test	old body captured HTTP/2 readLoop to github.com, hung >8s	rewritten PASS 1.02s, no real net
cloud test	TestRequestToken_DeviceLoginTimeout FAIL: "hung >2s" (3.00s)	PASS: ctx cancelled <1s, DeadlineExceeded

Phase 2 — GGA installs OpenCode CLI (REQ-CI-011)

GGA shells out to the opencode binary, but gga.yml never installed it. Added an Install OpenCode CLI step (curl -fsSL https://opencode.ai/install | bash) plus $HOME/.opencode/bin → $GITHUB_PATH (the installer also self-appends; this is an idempotent safety net), and a Verify OpenCode CLI step. The job's existing continue-on-error absorbs installer failures so a flaky external installer cannot block PRs.

Phase 3 — Scope -race to ubuntu; weekly full-race sweep (REQ-CI-010)

• ci.yml Test job: include matrix pairing each OS with a race bool; test step runs go test -shuffle=on ${{ matrix.race && '-race' || '' }} ./.... -race now only on ubuntu-latest per PR.
• New .github/workflows/ci-full-race.yml: cron: '0 6 * * 1' (Monday 06:00 UTC) + workflow_dispatch, 3-OS matrix, go test -race -shuffle=on ./... — closes the Windows/macOS race gap weekly.
• setup-go@v5 default cache: true already applies (no change). tparse unused (no change). All three YAML files validate.

Verification

• go test ./... — green (full suite)
• go test ./cmd/ ./internal/cloud/ — green
• golangci-lint run ./... — 0 issues
• python3 -c yaml.safe_load on all 3 modified/new workflow files — OK

Changed files

File	Change
internal/cloud/oauth_device.go	deviceLoginTimeout + context.WithTimeout + ctx-threaded helpers + pollForAccessToken
internal/cloud/oauth_device_test.go	TestRequestToken_DeviceLoginTimeout (TDD)
cmd/login_test.go	TestRunLogin_EmptyToken deterministic rewrite (TDD)
.github/workflows/gga.yml	Install + verify OpenCode CLI
.github/workflows/ci.yml	-race scoped to ubuntu via include matrix
.github/workflows/ci-full-race.yml	new weekly full-race sweep

Notes

• 3 atomic commits (one per phase). Affected code/CI ~206 changed lines; SDD artifact trail (proposal/spec/design/tasks) included under openspec/changes/fix-ci-hygiene/.
• tasks.md checked the design's corrected approach; the proposal's rejected DI-field symbols are documented as deviations.