fix: improve test compatibility for OpenCode and OAuth credentials

- Add test_permission_mode() helper to use "default" for OpenCode
  (it only supports default, not bypass or plan modes)
- Fix OAuth health check to accept 403 "Missing scopes" as valid auth
  (OAuth tokens may lack api.model.read scope but still work for agents)
- Skip OpenCode in approval_flow_snapshots (doesn't support plan mode)
- Make sessions_list_global snapshot agent-agnostic (just check count)
- Add new snapshots for Codex and OpenCode agents

server/packages/agent-management/src/testing.rs

@@ -252,7 +252,22 @@ fn handle_health_response(
     if status.is_success() {
         return Ok(());
     }
-    if status == StatusCode::UNAUTHORIZED || status == StatusCode::FORBIDDEN {
+    // 401 always means invalid credentials
+    if status == StatusCode::UNAUTHORIZED {
+        return Err(TestAgentConfigError::InvalidCredentials {
+            provider: provider.to_string(),
+            status: status.as_u16(),
+        });
+    }
+    // 403 could mean invalid credentials OR valid OAuth token with missing scopes
+    // Check the response body to distinguish
+    if status == StatusCode::FORBIDDEN {
+        let body = response.text().unwrap_or_default();
+        // OAuth tokens may lack scopes for /v1/models but still be valid
+        // "Missing scopes" means the token authenticated successfully
+        if body.contains("Missing scopes") || body.contains("insufficient permissions") {
+            return Ok(());
+        }
         return Err(TestAgentConfigError::InvalidCredentials {
             provider: provider.to_string(),
             status: status.as_u16(),