feat: bundle opencode plugin as open-code-review passthru + HM module

- packages/open-code-review/opencode-plugin.nix: builds the plugin TS file
  plus runtime node_modules from the plugin's package-lock.json into
  share/open-code-review/opencode (exposed as passthru.opencode-plugin,
  same source rev as the CLI so versions stay locked)
- modules/open-code-review-hm.nix: homeManagerModules.default with
  programs.open-code-review.{enable,opencode.enable} — symlinks the plugin
  and node_modules into ~/.config/opencode/plugins/ and installs the CLI
- flake.nix: expose homeManagerModules.default

Note: upstream declares the plugin SDKs as devDependencies, so the
lockfile install must not use --omit=dev.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

packages/open-code-review/opencode-plugin.nix

@@ -0,0 +1,92 @@
+# OpenCode plugin for OpenCodeReview, built from the same source revision as
+# the CLI (see package.nix). Ships the plugin TypeScript file plus the runtime
+# node_modules resolved from the plugin's package-lock.json, so OpenCode can
+# import `@opencode-ai/plugin` (v1.x) and `@opencode/plugin` (v2.x) without a
+# network install.
+{
+  lib,
+  stdenv,
+  nodejs,
+  fetchNpmDeps,
+  src,
+  version,
+}:
+
+let
+  pluginDir = "plugins/open-code-review/opencode";
+
+  lockfileCopy = ''
+    cp ${pluginDir}/package-lock.json ./package-lock.json
+    chmod +w package-lock.json
+  '';
+
+  npmDeps = fetchNpmDeps {
+    name = "open-code-review-opencode-plugin-npm-deps";
+    inherit src;
+    postPatch = lockfileCopy;
+    hash = "sha256-s5BO+JJJ9qZkKRTDmWyfBFVKB9GEeqObzyJ1lkORQo0=";
+  };
+in
+stdenv.mkDerivation {
+  pname = "open-code-review-opencode-plugin";
+  inherit version src;
+
+  # The lockfile lives in plugins/open-code-review/opencode/, but fetchNpmDeps
+  # and npm ci expect it at the package root.
+  postPatch = lockfileCopy;
+
+  # Exposed as an env var; used as the offline npm cache in installPhase.
+  inherit npmDeps;
+
+  # No build steps needed: the plugin is a single .ts file that OpenCode's
+  # runtime transpiles on the fly; only node_modules is materialized.
+  dontBuild = true;
+  dontConfigure = true;
+
+  nativeBuildInputs = [ nodejs ];
+
+  # OpenCode resolves plugin imports Node-style: node_modules next to the
+  # plugin file, or in any parent directory (resolved via the file's realpath).
+  # Install both the plugin file and node_modules so the plugin works whether
+  # users symlink the file only, the plugin dir, or point OpenCode at the
+  # store path directly.
+  installPhase = ''
+    runHook preInstall
+
+    pushd ${pluginDir}
+
+    # NOTE: upstream's package.json declares the plugin SDKs as
+    # devDependencies, so --omit=dev must NOT be used — it would install
+    # nothing. The full lockfile install is required.
+    npm ci \
+      --ignore-scripts \
+      --no-audit \
+      --no-fund \
+      --no-progress \
+      --loglevel=error \
+      --offline \
+      --cache "$npmDeps"
+
+    pluginOut=$out/share/open-code-review/opencode
+    mkdir -p "$pluginOut"
+    cp open-code-review.ts "$pluginOut/"
+    cp -r node_modules "$pluginOut/"
+
+    popd
+    runHook postInstall
+  '';
+
+  passthru = {
+    # The plugin speaks the CLI's JSON protocol; use it with a matching CLI
+    # version (both are built from the same source revision here).
+    forCli = "open-code-review";
+  };
+
+  meta = with lib; {
+    description = "OpenCode plugin exposing OpenCodeReview as native tools and slash commands";
+    homepage = "https://github.com/alibaba/open-code-review";
+    changelog = "https://github.com/alibaba/open-code-review/releases/tag/v${version}";
+    license = licenses.asl20;
+    platforms = platforms.all;
+  };
+}