feat(opencode): add ibmi column-info tool and harden permissions

- add the get_column_info custom tool for the ibmi-mcp-server and
  relocate its --tools path from a hardcoded absolute path into the
  version-controlled tree via {env:HOME} interpolation
- reorder permission rules so "rm -rf *" (deny) is no longer shadowed
  by "rm *" (ask); last-match-wins now resolves rm -rf to deny
- add allow rules for the Python toolchain (unittest, py_compile,
  venv activation, ruff check/format)
- rename plugin/ to plugins/ to match the documented plural convention
- commit package.json and package-lock.json so the ibmi-gate plugin
  resolves @opencode-ai/plugin on a fresh stow
- correct the README opencode directory description

.config/opencode/plugins/ibmi-gate.ts

@@ -0,0 +1,35 @@
+/*
+Gate the ibmi-mcp-server on its required environment variables.
+
+opencode's config schema types `mcp.<name>.enabled` as a static boolean and
+only interpolates `{env:VAR}` for string values (headers, environment
+entries), never for the `enabled` flag. Conditionally enabling a server is
+therefore not expressible in opencode.jsonc alone.
+
+This plugin uses the `config` hook, which runs once at startup with the live
+merged config (before MCP servers spawn), to flip `ibmi-server.enabled` to
+`true` only when every required credential is present. The config keeps
+`enabled: false` as a fallback default, so the server stays off if this
+plugin fails to load.
+ */
+
+import type { Plugin } from "@opencode-ai/plugin";
+
+// Credentials the ibmi-server MCP needs to connect. All must be non-empty.
+const REQUIRED_ENV = ["DB2i_HOST", "DB2i_USER", "DB2i_PASS"] as const;
+const SERVER = "ibmi-server";
+
+export default (async () => {
+  return {
+    config: (cfg) => {
+      const ready = REQUIRED_ENV.every((name) => {
+        const value = process.env[name];
+        return typeof value === "string" && value.length > 0;
+      });
+      const server = cfg.mcp?.[SERVER];
+      if (server && typeof server === "object") {
+        (server as { enabled?: boolean }).enabled = ready;
+      }
+    },
+  };
+}) satisfies Plugin;