- Add test_permission_mode() helper to use "default" for OpenCode
(it only supports default, not bypass or plan modes)
- Fix OAuth health check to accept 403 "Missing scopes" as valid auth
(OAuth tokens may lack api.model.read scope but still work for agents)
- Skip OpenCode in approval_flow_snapshots (doesn't support plan mode)
- Make sessions_list_global snapshot agent-agnostic (just check count)
- Add new snapshots for Codex and OpenCode agents