chore: bump opencode 1.17.15 -> 1.17.20 + pre-flight version-check guidance

- Dockerfile.variant: OPENCODE_VERSION 1.17.15 -> 1.17.20 (latest stable on npm,
  verified via npm view). Variant-only layer; base image untouched.
- AGENTS.md: Pre-flight check now requires checking whether opencode is behind
  and ASKING THE USER before bumping ahead of a release CI build; links the
  bg-subagents removal-trigger re-check.
- CHANGELOG Unreleased: record the bump; 1.17.16-1.17.20 are TUI/cosmetic +
  internal fixes; bg-subagents removal-trigger re-checked, not fired.

AGENTS.md

@@ -51,8 +51,7 @@ repo, which decoupled from the pi tool version at its own `v1.0.0`.
 - **PATCH** — opencode/tool version bumps and small fixes that don't change the
   contract. When a release pairs a tool bump with a feature, the feature wins
   and it's a minor.
-- **Pre-flight check** — whenever an opencode bump is part of the release,
-  verify it is real before claiming it in the CHANGELOG:
+- **Pre-flight check** — **before triggering any release CI build, check whether opencode is behind and offer to bump it.** Compare the pinned `OPENCODE_VERSION` in `Dockerfile.variant` against the latest npm release (`./check-versions.sh Dockerfile.variant` flags `→ X available` for opencode — note the base-only pins like `GOSU_VERSION` live in `Dockerfile.base`, so run it against that too for a full sweep). **If the latest stable `opencode-ai` is newer than the pin, ASK THE USER whether to bump before the build — never bump silently;** a version bump is a functional change they may want to hold or schedule. When a bump *is* part of the release, re-check the `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` removal-trigger against the new version's release notes (see the bg-subagents note under *Critical conventions*), then verify the pin is real before claiming it in the CHANGELOG:
   ```bash
   npm view opencode-ai version           # must equal the X.Y.Z you pin in Dockerfile.variant
   ```

CHANGELOG.md

@@ -20,6 +20,13 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
   `OPENCODE_MODEL` example in `.env.example`. Takes effect for new containers
   when no explicit `OPENCODE_MODEL` override is set. The `openai` default
   (`gpt-5.4`) is unchanged.
+- **opencode bumped `1.17.15` → `1.17.20`** (`Dockerfile.variant`
+  `OPENCODE_VERSION`; latest stable on npm, verified via `npm view
+  opencode-ai version`). 1.17.16–1.17.20 are TUI/cosmetic and internal fixes
+  (command-palette flash, sub-agent task-row styling, an OpenAI Responses
+  workaround removal) — no config-affecting or breaking changes. The
+  `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` removal-trigger was re-checked
+  against these release notes and has **not** fired; the flag stays baked ON.
 
 ## v2.7.0 — 2026-07-13
 

Dockerfile.variant

@@ -39,7 +39,7 @@ ARG USER_NAME=developer
 # edit, so the cache-hit class of bug that bit pi-devbox v0.74.0..
 # v0.75.5 cannot apply here.
 ARG INSTALL_OPENCODE=true
-ARG OPENCODE_VERSION=1.17.15
+ARG OPENCODE_VERSION=1.17.20
 RUN if [ "${INSTALL_OPENCODE}" = "true" ]; then \
       NPM_CONFIG_PREFIX=/usr npm install -g opencode-ai@${OPENCODE_VERSION} && \
       opencode --version ; \