fix: fresh config startup stalls on unnecessary plugin dependency installs

[anandgupta42]

A fresh configuration can trigger an unnecessary in-process Arborist installation of @opencode-ai/plugin, delaying HTTP requests and streamed output for minutes. PR #1292 records the 0.11.0 reproduction: a consent request waited about five minutes, and a first prompt took 149 seconds versus 33 seconds after dependencies were present.

To reproduce, run the compiled CLI with a fresh HOME/XDG environment, PURE unset, and no local plugins or tools. Start serve and request an instance endpoint such as /config or /provider. Bare config directories should not install packages, and instance requests should remain responsive.

The config callsite changed from an external BunProc installer to in-process Npm.Service in 9e4356302f, June 23, 2026, later merged through #964. The first stable release with that code was 0.9.1; this identifies the code boundary, not a performance bisect of historical binaries. Related upstream reports include anomalyco/opencode#27971 and #44684.

Acceptance:

• Bare config directories and external-only plugins cause no config dependency installs.
• Local tools/plugins still receive dependencies, including declarations merged later, package roots, and symlink aliases.
• Both Config and TuiConfig skip installs under PURE.
• A non-PURE subprocess regression test exercises real instance HTTP routes and rejects npm requests/install artifacts, with bounded timeouts and cleanup.
• The same check runs against the compiled Linux binary before release publication.

Implementation and regression tests: #1292.

[anandgupta42]

Resolved in v0.11.1 (npm latest). The install gate from #1292 ships there, together with the first-run health telemetry from #1294 that will surface any recurrence.