bin/: add 1Password CLI (op) and opencode

op is shipped as a zip rather than a tarball, so lib/fetch.sh grows an
install_zip_bin helper (unzip, falling back to python3's zipfile so
neither is a hard dependency).

Credentials for both stay per-box and out of this repo: op signs in via
`op signin` or OP_SERVICE_ACCOUNT_TOKEN, and opencode reaches the
covert-gpt gateway with the key that mcp-config/ syncs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/fetch.sh

@@ -73,6 +73,26 @@ install_tarball_bin() {
   fsay "installed $BIN_DIR/$3"
 }
 
+# install_zip_bin <url> <path-within-archive> <dest-name> — like
+# install_tarball_bin but for .zip assets (e.g. 1Password CLI). Uses unzip
+# when present, else python3's zipfile module, so no hard dependency on
+# either being installed.
+install_zip_bin() {
+  mkdir -p "$BIN_DIR"
+  _tmp="$(mktemp -d)"
+  _fetch_dl "$1" "$_tmp/archive.zip"
+  if command -v unzip >/dev/null 2>&1; then
+    unzip -q "$_tmp/archive.zip" -d "$_tmp"
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 -m zipfile -e "$_tmp/archive.zip" "$_tmp"
+  else
+    fsay "fetch: need unzip or python3 to extract zip"; rm -rf "$_tmp"; return 1
+  fi
+  install -m 0755 "$_tmp/$2" "$BIN_DIR/$3"
+  rm -rf "$_tmp"
+  fsay "installed $BIN_DIR/$3"
+}
+
 # install_raw_bin <url> <dest-name> — download a single raw binary.
 install_raw_bin() {
   mkdir -p "$BIN_DIR"