build(agent-job): pin Claude Code CLI; smoke one turn per runtime

Add @anthropic-ai/claude-code@2.1.207 to the job image global npm install,
extend the smoke script with claude --version plus a documented per-runtime
turn block, and reconcile OpenCode/Claude adapter flags against the real CLIs
(all assumed flags confirmed). Document the anthropic_oauth_json credential
snapshot pattern in the README.

apps/agent-worker/src/runtime/claude-adapter.ts

@@ -42,9 +42,9 @@ export const createClaudeAdapter: AdapterFactory = (deps) => {
     workspace.turnMarker = `spoon-turn-${randomUUID()}`;
     const marker = workspace.turnMarker;
 
-    // NOTE: exact flags are UNVERIFIED against the pinned CLI and are confirmed
-    // in Task 11's smoke. `--verbose` is required for `stream-json`;
-    // `--resume <sessionId>` carries continuity.
+    // Flags verified against `claude --help` (@anthropic-ai/claude-code@2.1.207):
+    // `-p`, `--output-format stream-json`, `--verbose`, `--dangerously-skip-permissions`,
+    // `--model`, and `--resume <sessionId>` (continuity) all exist.
     const argv = [
       'claude',
       '-p',

apps/agent-worker/src/runtime/opencode-adapter.ts

@@ -57,9 +57,8 @@ export const createOpenCodeAdapter: AdapterFactory = (deps) => {
     workspace.turnMarker = `spoon-turn-${randomUUID()}`;
     const marker = workspace.turnMarker;
 
-    // NOTE: `--session` continuity is UNVERIFIED against `opencode run --help` and
-    // may be dropped in Task 11's smoke; if unsupported, OpenCode turns are stateless
-    // (acceptable — Codex/Claude carry continuity).
+    // Flags verified against `opencode run --help` (opencode-ai@1.17.9):
+    // `--format json`, `--model`, and `--session <id>` all exist.
     const argv = [
       'opencode',
       'run',