Port lib/opencode/rails/ source files; strip Rails.event/Rails.error

Eleven source files moved from ajent-rails:lib/opencode/rails/ to
opencode-rails:lib/opencode/ (flat layout — modules are Opencode::*, not
Opencode::Rails::*; matches opencode-ruby).

  artifact.rb           63 LOC
  exchange.rb           77 LOC
  impostor.rb           48 LOC
  message_artifacts.rb 133 LOC
  sandbox_file.rb       81 LOC
  sandbox.rb            71 LOC
  session.rb           168 LOC
  tool_display.rb      423 LOC
  transform.rb          77 LOC
  turn.rb              642 LOC
  uploaded_files_prompt.rb 85 LOC
  ----
  total              1,868 LOC

Surgical Rails strips:

  exchange.rb:
    Rails.event.notify(name, payload)
      -> Opencode::Instrumentation.instrument(name, payload) { }

  message_artifacts.rb (1 call), turn.rb (6 calls):
    Rails.error.report(error, **opts)
      -> Opencode::ErrorReporter.report(error, **opts)

Comments/docstrings referencing Rails.error.report / Rails.event left
in place — they document how to wire the host adapter.

ActiveSupport core_ext requires expanded in lib/opencode-rails.rb to
cover Numeric#seconds, Hash#deep_stringify_keys, String#squish/truncate,
String#demodulize. Bundle install + smoke load confirms all 12
gem-provided constants resolve cleanly.

lib/opencode/transform.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Opencode
+  # A per-product rule that converts an Opencode::SandboxFile into an
+  # Opencode::Artifact, owning the trust boundary between "bytes the
+  # agent wrote" and "bytes the host signs and attaches."
+  #
+  # The default substrate path is identity: any sandbox file the
+  # allowlist accepts gets attached as-is. Blackline and Raven use
+  # the default — their agents `write` final document bytes the host
+  # serves back unchanged. AIGL's contract is structurally different:
+  # the agent writes JSON, the **host** must render that JSON into
+  # trusted HTML before attaching, because the resulting HTML gets
+  # served inline from the app origin and an agent-written filename
+  # can't be permitted as stored-XSS.
+  #
+  # Subclass hooks (override these — none have a generic default
+  # that's safe to inherit):
+  #
+  #   source_filename       — basename in the sandbox the transform
+  #                           reads from
+  #   destination_filename  — filename of the Artifact the transform
+  #                           returns from #render
+  #   render(sandbox_file)  — return an Artifact carrying the rendered
+  #                           bytes + trust metadata. Raise
+  #                           Opencode::Transform::Error to abort just
+  #                           this file (substrate logs + skips).
+  #   trusted?(attachment)  — true if the attachment was produced by
+  #                           this transform (used by Impostor.for and
+  #                           by view code that decides inline-render
+  #                           vs download). Default: filename match.
+  #   purge_impostors?      — if true, before attaching the substrate
+  #                           deletes any existing attachment whose
+  #                           filename matches destination_filename
+  #                           but fails trusted?. Default: false.
+  #
+  # `applies_to?(sandbox_file)` is the routing predicate the substrate
+  # uses to decide whether to send this file through this transform.
+  # Default is exact match against source_filename; override for
+  # multi-file or glob-style ownership.
+  class Transform
+    Error = Class.new(StandardError)
+
+    def destination_filename
+      raise NotImplementedError, "#{self.class.name} must implement #destination_filename"
+    end
+
+    def source_filename
+      raise NotImplementedError, "#{self.class.name} must implement #source_filename"
+    end
+
+    def applies_to?(sandbox_file)
+      sandbox_file.basename == source_filename
+    end
+
+    def render(_sandbox_file)
+      raise NotImplementedError, "#{self.class.name} must implement #render"
+    end
+
+    def trusted?(attachment)
+      attachment.filename.to_s == destination_filename
+    end
+
+    def purge_impostors?
+      false
+    end
+
+    # Names this transform owns end-to-end. The substrate uses this to
+    # keep its tool-extracted phase from racing the transform — the
+    # agent's raw payload (source_filename) and the rendered output
+    # (destination_filename) are both off-limits to the default attach
+    # path so the transform owns the slot.
+    def owned_filenames
+      [ source_filename, destination_filename ]
+    end
+  end
+end