Compiler must pass --enable-opencode to AWF when engine=opencode

## Problem

PR [github/gh-aw-firewall#2337](https://github.com/github/gh-aw-firewall/pull/2337) gates the OpenCode API proxy listener (port 10004) behind an explicit `--enable-opencode` CLI flag. Previously, the listener started unconditionally whenever any credential was present (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `COPILOT_AUTH_TOKEN`).

After this change lands, OpenCode workflows compiled by gh-aw will silently lose access to port 10004 because the compiler does not currently emit `--enable-opencode`.

## Current Behavior

- `BuildAWFArgs()` in `pkg/workflow/awf_helpers.go` does not emit `--enable-opencode`
- The OpenCode engine routes through an existing backend port (10000–10003) via `UniversalLLMConsumerEngine`, but port 10004 (OpenCode's unified dynamic-routing endpoint) will no longer start

## Expected Behavior

When `config.EngineName == "opencode"`, the compiler should:

1. **Add `--enable-opencode` to AWF args** in `BuildAWFArgs()`
2. **Add port 10004 to `--allow-host-ports`** so the agent container can reach the OpenCode listener
3. **Gate behind a minimum AWF version** (the firewall version that ships PR #2337) — skip the flag for older pinned versions

## Implementation Notes

- The flag is a CLI flag to the `awf` binary (not part of the config file schema)
- AWF internally maps it to `AWF_ENABLE_OPENCODE=true` env var in the api-proxy container
- `--enable-opencode` requires `--enable-api-proxy` (which gh-aw already enables via the config file's `apiProxy.enabled: true`)
- Port 10004 is used for OpenCode's dynamic provider routing (separate from per-engine ports 10000–10003)
- Follow the pattern used by `--difc-proxy-host` (gated on `awfSupportsCliProxy`) or `--allow-host-ports` (gated on `awfSupportsAllowHostPorts`)

## Files to Modify

- `pkg/workflow/awf_helpers.go` — Add `--enable-opencode` in `BuildAWFArgs()` when engine is opencode
- `pkg/workflow/awf_helpers.go` — Include port 10004 in `--allow-host-ports` for opencode
- `pkg/constants/` — Add `AWFEnableOpenCodeMinVersion` constant
- `pkg/workflow/awf_helpers_test.go` — Test the new flag emission
- `pkg/workflow/enable_api_proxy_test.go` — Add OpenCode to the proxy enablement tests

## Depends On

- [github/gh-aw-firewall#2337](https://github.com/github/gh-aw-firewall/pull/2337) (must be merged and released first)