chore: bump opencode 1.17.15 -> 1.17.20 + pre-flight version-check guidance

- Dockerfile.variant: OPENCODE_VERSION 1.17.15 -> 1.17.20 (latest stable on npm,
  verified via npm view). Variant-only layer; base image untouched.
- AGENTS.md: Pre-flight check now requires checking whether opencode is behind
  and ASKING THE USER before bumping ahead of a release CI build; links the
  bg-subagents removal-trigger re-check.
- CHANGELOG Unreleased: record the bump; 1.17.16-1.17.20 are TUI/cosmetic +
  internal fixes; bg-subagents removal-trigger re-checked, not fired.

AGENTS.md

@@ -51,8 +51,7 @@ repo, which decoupled from the pi tool version at its own `v1.0.0`.
 - **PATCH** — opencode/tool version bumps and small fixes that don't change the
   contract. When a release pairs a tool bump with a feature, the feature wins
   and it's a minor.
-- **Pre-flight check** — whenever an opencode bump is part of the release,
-  verify it is real before claiming it in the CHANGELOG:
+- **Pre-flight check** — **before triggering any release CI build, check whether opencode is behind and offer to bump it.** Compare the pinned `OPENCODE_VERSION` in `Dockerfile.variant` against the latest npm release (`./check-versions.sh Dockerfile.variant` flags `→ X available` for opencode — note the base-only pins like `GOSU_VERSION` live in `Dockerfile.base`, so run it against that too for a full sweep). **If the latest stable `opencode-ai` is newer than the pin, ASK THE USER whether to bump before the build — never bump silently;** a version bump is a functional change they may want to hold or schedule. When a bump *is* part of the release, re-check the `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` removal-trigger against the new version's release notes (see the bg-subagents note under *Critical conventions*), then verify the pin is real before claiming it in the CHANGELOG:
   ```bash
   npm view opencode-ai version           # must equal the X.Y.Z you pin in Dockerfile.variant
   ```