Feat: Add OpenCode run parameters to agent steps

[tbrandenburg]

Problem

Flowsh agent steps could only express agent, prompt, and expandPrompt. Workflows that needed OpenCode's non-interactive --model, --command, or explicit --dangerously-skip-permissions flags were rejected by strict YAML validation instead of rendering the intended opencode run invocation.

Solution

Extend the existing Python CLI blueprint in place. The AgentStep model now accepts model, command, and dangerouslySkipPermissions, with dangerously-skip-permissions as an accepted alias. Generated harnesses keep the existing Bash array command pattern and append all optional OpenCode flags before --, so prompt text remains message content.

Changes

• Updated src/flowsh_cli/models.py with strict optional fields, shared string validation, and duplicate dangerous-alias rejection.
• Updated src/flowsh_cli/render.py to pass --agent, --model, --command, and --dangerously-skip-permissions through run_agent().
• Added parser, schema, validation, and fake-OpenCode argv tests in tests/test_workflow_to_harness.py.
• Updated README.md with the supported YAML and security-sensitive dangerous permission behavior.
• Added the completed plan and implementation report under .claude/PRPs/.

Testing

• make lint: passed.
• uv run --locked pytest tests/test_workflow_to_harness.py -q: 76 passed.
• make build && uv run --locked flowsh-cli --schema: passed; schema includes new AgentStep fields.
• make qa: passed locally and again in the push hook with 76 tests passing and package build succeeding.

Example Output

run
--format
json
--agent
general
--model
provider/model
--command
review
--dangerously-skip-permissions
--
--help

Notes

• model values intentionally allow provider/model IDs like openai/gpt-5; they do not reuse the stricter agent name regex.
• If both dangerous permission aliases are present, validation rejects the step rather than relying on Pydantic alias priority.
• No new dependencies or step types were added.