docs+chore: refresh bg-subagents markers to 1.17.20/omos 2.2.0, link THIRD_PARTY, guard build-args table

- Dockerfile.base + AGENTS.md: bg-subagents removal-trigger last-checked markers
  1.17.15/omos 2.1.0 -> 1.17.20/omos 2.2.0 (re-verified; trigger still not fired).
  The Dockerfile.base comment edit changes the base-content hash, so base-<hash>
  advances and the base image rebuilds on the next release.
- README: refresh stale OPENCODE_VERSION build-arg examples (1.5.0, 1.17.8 -> 1.17.20);
  link THIRD_PARTY.md from the License section.
- AGENTS.md: adding a new floated *_VERSION ARG must also update the README Build Args
  table (closes the coupling gap that hid MICRO/TEALDEER/TYPST for 3 releases).
- CHANGELOG Unreleased: record both under Changed + Documentation.

README.md

@@ -452,7 +452,7 @@ Enable optional language runtimes, pin a specific opencode version, or lock any
 
 ```bash
 docker compose build --build-arg INSTALL_GO=true
-docker compose build --build-arg OPENCODE_VERSION=1.5.0
+docker compose build --build-arg OPENCODE_VERSION=1.17.20
 docker compose build --build-arg NVIM_VERSION=0.12.1   # pin to a specific version
 ```
 
@@ -683,7 +683,7 @@ docker build -f Dockerfile.base -t myorg/opencode-devbox:base-dev \
 # then the variant FROM that base
 docker build -f Dockerfile.variant -t myorg/opencode-devbox:dev \
   --build-arg BASE_IMAGE=myorg/opencode-devbox:base-dev \
-  --build-arg OPENCODE_VERSION=1.17.8 .
+  --build-arg OPENCODE_VERSION=1.17.20 .
 ```
 
 Note: mempalace-toolkit clones anonymously (no token needed). Only the `resolve-versions` CI job calls the gitea API (which needs a token for public repos). A plain `docker build` like the above skips that job entirely, so no credentials are required.
@@ -890,4 +890,4 @@ Container (Debian trixie)
 
 ## License
 
-MIT
+MIT — see [`LICENSE`](LICENSE). The MIT license covers this repository's own contents (Dockerfiles, entrypoint scripts, `rootfs/` seeds, CI workflows, docs). The **published container images** additionally *bundle* third-party software, each under its own terms — see [`THIRD_PARTY.md`](THIRD_PARTY.md) for the summary.