bin/: add 1Password CLI (op) and opencode

op is shipped as a zip rather than a tarball, so lib/fetch.sh grows an
install_zip_bin helper (unzip, falling back to python3's zipfile so
neither is a hard dependency).

Credentials for both stay per-box and out of this repo: op signs in via
`op signin` or OP_SERVICE_ACCOUNT_TOKEN, and opencode reaches the
covert-gpt gateway with the key that mcp-config/ syncs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/install.sh

@@ -127,6 +127,35 @@ install_tofu() {
   mark_version tofu "$ver"
 }
 
+# op — 1Password CLI, used for secrets storage/retrieval (op read, op run,
+# op inject). Single static binary shipped as a zip. Sign in with
+# `op signin` or a service-account token (OP_SERVICE_ACCOUNT_TOKEN) —
+# credentials are per-box and never live in this repo.
+install_1p() {
+  ver=2.34.1
+  have_version op "$ver" && { fsay "op $ver already installed."; return 0; }
+  install_zip_bin \
+    "https://cache.agilebits.com/dist/1P/op2/pkg/v$ver/op_linux_${DEB}_v$ver.zip" \
+    op op
+  mark_version op "$ver"
+}
+
+# opencode — terminal AI coding agent. Points at the covert-gpt LiteLLM
+# gateway via mcp-config/opencode.gateway.json (synced by mcp-config/).
+# Release assets use x64/arm64 tokens rather than amd64/x86_64.
+install_opencode() {
+  ver=v1.17.18
+  have_version opencode "$ver" && { fsay "opencode $ver already installed."; return 0; }
+  case "$DEB" in
+    amd64) _oc_arch=x64 ;;
+    *) _oc_arch=arm64 ;;
+  esac
+  install_tarball_bin \
+    "https://github.com/sst/opencode/releases/download/$ver/opencode-linux-$_oc_arch.tar.gz" \
+    opencode opencode
+  mark_version opencode "$ver"
+}
+
 # task — go-task, the Taskfile.yml task runner. Binary is at the archive root.
 install_task() {
   ver=v3.52.0
@@ -163,5 +192,7 @@ install_yq
 install_tofu
 install_task
 install_terragrunt
+install_1p
+install_opencode
 
 fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."