orchestrator-host: symlink the opencode installer's binary into ~/.local/bin; README: nginx file perms, first-rebuild wrapper, pre-cutover checks

Found on the first activation of #cc-ci on 195.201.88.249: the opencode
installer lands in ~/.opencode/bin (opencode-web then failed at EXEC), and
nginx's pre-start config check runs as the nginx user, so the staged
cert/htpasswd must be root:nginx 0640, not root:root 0600.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/modules/orchestrator-host.nix

@@ -145,6 +145,10 @@ SSHCFG
         if [ ! -x "$HOME/.local/bin/opencode" ]; then
           echo "installing opencode CLI for loops user..."
           curl -fsSL https://opencode.ai/install | bash || echo "install failed — retry on next activation"
+          # The installer puts the binary in ~/.opencode/bin; every unit here expects ~/.local/bin.
+          if [ -x "$HOME/.opencode/bin/opencode" ]; then
+            mkdir -p "$HOME/.local/bin" && ln -sfn "$HOME/.opencode/bin/opencode" "$HOME/.local/bin/opencode"
+          fi
         fi
       '';
     };