ci: gate publishes on host e2e behavior suite (#119 follow-up)

Adds e2e-host-opencode and e2e-host-pi jobs to both ci.yml and
release.yml. They run the packages/e2e-tests behavior suite (36
OpenCode + 38 Pi active tests) against the embedded mock provider,
spawning real opencode serve and Pi subprocesses.

Why two e2e layers:
  - Docker e2e (existing): fresh-install smoke. Plugin loads, doctor
    clean, one mock turn produces DB rows with the right harness.
    Catches packaging / install-flow regressions.
  - Host e2e (new):        behavior assertions. Byte-level wire
    diffs, multi-turn cache stability, historian publish behavior,
    tag-owner collision, synthetic todowrite, cross-harness memory,
    subagent isolation, etc. Catches cache-stability and correctness
    regressions the smoke layer cannot see.

Pipeline shape (release.yml):
  unit → docker e2e → host e2e → 3x npm publish → github-release → discord

For CI:
  unit → docker e2e → host e2e

Host jobs gated on Docker e2e — no point exercising deep behavior
if install is broken. Publishes gated on host e2e — a tag that
breaks any of the ~74 host tests will block npm publish.

NODE_ENV is explicitly cleared in the run step so the spawned
opencode subprocess gets normal runtime behavior (project memory:
'For OpenCode e2e subprocesses, unset inherited NODE_ENV').

Pi binary is resolved via createRequire against the
@earendil-works/pi-coding-agent workspace dep, so no separate Pi
install is needed beyond `bun install`.

OpenCode is installed the same way Docker e2e does:
  curl -fsSL https://opencode.ai/install | bash